21d01722dffd6a6052e92e89ea2f78a815e9f38d36126e18afca71457f65bd4f | Triage

Analysis

max time kernel
188s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 15:05

Sharing

Report Analysis Logs

General

Target

Fraps/LOLPRO.exe
Size

544KB
MD5

d1cdf07b0a0587c72b55146081b0464c
SHA1

8358e460c9909087750cc121c057ec65321a0f19
SHA256

4623511d7ad5912be5ed0c89f9227d65ae6309dbcb9f4c40fdcba90012261cf1
SHA512

25c43884a9313d0041e181bf5a0b91550ad5db9c9552bee9b61a25ecf55e9b10ffc321f4fb0308bb08654bae1218470c82e479a6dcd7a10b16501f6526a06382
SSDEEP

12288:gtqYAXhL0Kg3bWC9wFqV/Y1lh/pg81EPC:KqzL0mC+FqUg8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4528	3320	WerFault.exe	79

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3320	LOLPRO.exe
3320	LOLPRO.exe

C:\Users\Admin\AppData\Local\Temp\Fraps\LOLPRO.exe
"C:\Users\Admin\AppData\Local\Temp\Fraps\LOLPRO.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 588
  2⤵
  - Program crash
  PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3320 -ip 3320
1⤵
PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads