460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820

Analysis

max time kernel
140s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-06-2023 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Size

300KB
MD5

f298cdef9475c31e2095210d85e29414
SHA1

b1a707619eeb33941baa3cf610b83bec1fe12bdb
SHA256

460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820
SHA512

3c4dbe3b5074e4df4c1729c13a0ef144f9de007f835a17c722532dc573862ad4fa5c4fd0be9c606b27082d9278196c9ff26b72118b83698154bf7c503250c3be
SSDEEP

6144:N/QuX5B+qRyY99qyFpvcIvLyr+WlFFPOsxa9RISEBi:muXz+6yYrqyTh+jOsxgRISEE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1928 2008 WerFault.exe 460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

pid	pid_target	process	target process
1928	2008	WerFault.exe	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

Modifies registry class 10 IoCs

Processes:

460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler\Clsid	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler\ = "this is my ebook"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.MyNSHandler"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe

description	pid	process	target process
PID 2008 wrote to memory of 1928	2008	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe	WerFault.exe
PID 2008 wrote to memory of 1928	2008	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe	WerFault.exe
PID 2008 wrote to memory of 1928	2008	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe	WerFault.exe
PID 2008 wrote to memory of 1928	2008	460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe
"C:\Users\Admin\AppData\Local\Temp\460248f165dd3feefd5cbc8e09e18be3c6afba0822a48a102eb13e42ff757820.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 400
2⤵
- Program crash
PID:1928

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-54-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2008-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download