9a12d141eef4c1094654e69a1ed069ec1148f73c98d26ce516d0ca24b1fe174a | Triage

Analysis

max time kernel
80s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2023 17:27

Sharing

Report Analysis Logs

General

Target

HEUR-Trojan.Win32.exe
Size

128KB
MD5

5ec96b67ac6587cc4bbfef31e7d1f248
SHA1

9776341d2473c3d1e7e4a8046a3e9e772d6aa664
SHA256

9a12d141eef4c1094654e69a1ed069ec1148f73c98d26ce516d0ca24b1fe174a
SHA512

50c3e5e2c3a7d57df3d21f7c858095416bad037f5cf415ea52d6998db23459fa4908dd25ace9d8b943f79b92f580744bb9ecbf3c081416d33d3bf98accb971fc
SSDEEP

3072:YdgRDhNuD6K1b9wGRUTPipLDjm2sKaOyQ+xv3Vgefy6Ep:YajuD6O3RWwLDjmJKao+lFj3Ep

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2164	2032	WerFault.exe	83
4124	2032	WerFault.exe	83

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	HEUR-Trojan.Win32.exe
2032	HEUR-Trojan.Win32.exe

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 460
  2⤵
  - Program crash
  PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 500
  2⤵
  - Program crash
  PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2032 -ip 2032
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2032 -ip 2032
1⤵
PID:208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads