07e8b6bfd30b75856ea485328c8b0000d93ab3b2040850b0013120f5e4809c3b | Triage

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2023 09:48

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

2.0MB
MD5

60d1393e0562bbc0d8becdb57a7d24a6
SHA1

5c3137ff2ef5c8e8b8ad1761987ebb4ba3694ce6
SHA256

07e8b6bfd30b75856ea485328c8b0000d93ab3b2040850b0013120f5e4809c3b
SHA512

d8020d50ec336a032666005364ed793226cf1f1c8e234bb8ea184832cc094072c45d0a395785e5f12fe978b5fb8314b9202907a5af0bfda539f10be84226cadb
SSDEEP

49152:Ei+NZN0jatXpPApLnH+MVWdYtsw3hM7HOrvbD+EEL:D+NZN0jc2nH+MVWdKsOhM7HOrjDA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	2200	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 736
  2⤵
  - Program crash
  PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2200 -ip 2200
1⤵
PID:3628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads