41554c195bc8c87ddb8bbeacefe77c033f56549a03361dd76c2243546dd1f2d8 | Triage

Resubmissions

02/11/2023, 21:08

231102-zy2f4shf43 10

02/11/2023, 19:29

231102-x7fjwsec8w 10

30/06/2023, 11:57

230630-n4mdlaae31 7

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 11:57

Sharing

Report Analysis Logs

General

Target

payload.exe
Size

9.0MB
MD5

f6c5df8944a965d0d3aa2e124a1935af
SHA1

3ff36a13827d193a85eed40b59646bad1d676986
SHA256

41554c195bc8c87ddb8bbeacefe77c033f56549a03361dd76c2243546dd1f2d8
SHA512

8d75df03c33e9288b2d4b9e941c89ca2e0e7008e151ee3c104292427266043050f9966d0ff6e5c46890bde404337873768a4cde255778418144766646d08ceae
SSDEEP

196608:cTEcVnJULKrytYcJX7Nfjw9cI1qyz+6weSn5NeCX4X6:4EcVnukcJLtlIwqwemrePX6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4576	2016	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2016	payload.exe
2016	payload.exe

C:\Users\Admin\AppData\Local\Temp\payload.exe
"C:\Users\Admin\AppData\Local\Temp\payload.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2016 -s 572
  2⤵
  - Program crash
  PID:4576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 2016 -ip 2016
1⤵
PID:444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-133-0x00007FF844470000-0x00007FF844472000-memory.dmp

Filesize
8KB

Download
memory/2016-134-0x00007FF745210000-0x00007FF7462A7000-memory.dmp

Filesize
16.6MB

Download