Analysis

  • max time kernel
    75s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-06-2023 19:41

General

  • Target

    21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe

  • Size

    4.6MB

  • MD5

    ed065e03d90812f4f2191944cabaa193

  • SHA1

    45940d71ce3730fe00cd172901a2867623bc0a9d

  • SHA256

    21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537

  • SHA512

    b6b7448a8a0b531d094a48c3f86a140eab93556427e51baa16768440c1fe5c6741f35204b98704aa5ca9f02ff8becac2b3d1128a077ce85f392557be3757ba13

  • SSDEEP

    49152:PB8+oa6bXQn04bHXuPugPnTBVuscOjZ7wG2VXVscK0oKdTH4AUKyYTIiBS4Yy9hH:J7b3uPuGjZEGs6uipUTYy927HM9GWFj

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe
    "C:\Users\Admin\AppData\Local\Temp\21acdf5616dd7c67e4039eec9d981a78b9cea077dfadff4e290dbea2c3e24537.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    PID:2800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1652
      2⤵
      • Program crash
      PID:3212
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2800 -ip 2800
    1⤵
      PID:4716

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Fonts\rwtzid.dll
      Filesize

      1004KB

      MD5

      1938bc501c2cbaacdd8e4a1fe4441b53

      SHA1

      7894d0d1f00d8293913392601fc8af07015f4945

      SHA256

      57252baf752a552e600a7a86d0040c44822de3b3fe7ca42f873501bb643e92fe

      SHA512

      b8ddd2d3e5df03683de540fdb720dca47c545e1877727474559576664d226b0c2dc713f6afb98b95f1150bb2ac8f65d33b3446530d2c9cc8fe0b0ecf25380212