Analysis

  • max time kernel
    5s
  • max time network
    6s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2023 18:45

General

  • Target

    1ef84b11edcd948a3c02c81f50661c2e.exe

  • Size

    604KB

  • MD5

    1ef84b11edcd948a3c02c81f50661c2e

  • SHA1

    a81e639cf8391df668ab2333538bc7e838efef46

  • SHA256

    f7a348fc491b26c41a96f3f5498f72bb7e736e9981926831a88b76aae0117c79

  • SHA512

    20b9c843d91224ca0fcbe92b2743afe42e41e638d16bd2524317ed46560afcae63d60fa29d35a5273be343ccd4fc5fe27807b60766bb9ceb3ecd55eb2e830acb

  • SSDEEP

    6144:+dFD2uPNDHDTb+HdtH9Wd1yxBMf2esCDj2cp4DwK3bnqpnobns+NOYuR6QCwUjyU:+Plj+Hdsy7Mf9sbcps3rHn46QCVjq0XL

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ef84b11edcd948a3c02c81f50661c2e.exe
    "C:\Users\Admin\AppData\Local\Temp\1ef84b11edcd948a3c02c81f50661c2e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c embedded.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Users\Admin\AppData\Local\Temp\embedded.exe
        embedded.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          4⤵
            PID:460
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 408
              5⤵
              • Program crash
              PID:2744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 460 -ip 460
      1⤵
        PID:4140

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\embedded.exe

        Filesize

        66KB

        MD5

        140d24af0c2b3a18529df12dfbc5f6de

        SHA1

        e8db5ad2b7ffede3e41b9c3adb24f3232d764931

        SHA256

        4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

        SHA512

        a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

      • C:\Users\Admin\AppData\Local\Temp\embedded.exe

        Filesize

        66KB

        MD5

        140d24af0c2b3a18529df12dfbc5f6de

        SHA1

        e8db5ad2b7ffede3e41b9c3adb24f3232d764931

        SHA256

        4eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92

        SHA512

        a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415

      • memory/3124-138-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB