Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2023, 20:06

General

  • Target

    3a2857450222e1742d8c450ec4f7f96384d2e55a5f105767ad5ab8672960610d.exe

  • Size

    5.5MB

  • MD5

    73d42000b26777da69788ea24e1cc066

  • SHA1

    bd3a68e6dc861d91ac16541424279367c3c72d21

  • SHA256

    3a2857450222e1742d8c450ec4f7f96384d2e55a5f105767ad5ab8672960610d

  • SHA512

    49247fc4c63e15270dc831d7e33863809c0e57ad12a656b6be7ce15dae344101b7b29f687ea6cf495328cc8ce4f895cd400e27b0c05dba81f65e210eb27f6019

  • SSDEEP

    98304:g77OCQh1Era9WjNw9iyt/5OalsDon7795sSSAtr3pB:U8E08Nw9iyt/ts6v9bSM3j

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a2857450222e1742d8c450ec4f7f96384d2e55a5f105767ad5ab8672960610d.exe
    "C:\Users\Admin\AppData\Local\Temp\3a2857450222e1742d8c450ec4f7f96384d2e55a5f105767ad5ab8672960610d.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 884
      2⤵
      • Program crash
      PID:3344
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1160 -ip 1160
    1⤵
      PID:2368

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1160-133-0x0000000010000000-0x000000001001A000-memory.dmp

      Filesize

      104KB

    • memory/1160-134-0x0000000077210000-0x0000000077300000-memory.dmp

      Filesize

      960KB

    • memory/1160-135-0x0000000002AA0000-0x0000000002B90000-memory.dmp

      Filesize

      960KB

    • memory/1160-136-0x0000000077210000-0x0000000077300000-memory.dmp

      Filesize

      960KB

    • memory/1160-137-0x0000000003520000-0x00000000037F5000-memory.dmp

      Filesize

      2.8MB

    • memory/1160-138-0x0000000010000000-0x000000001001A000-memory.dmp

      Filesize

      104KB

    • memory/1160-139-0x0000000077210000-0x0000000077300000-memory.dmp

      Filesize

      960KB

    • memory/1160-140-0x0000000003520000-0x00000000037F5000-memory.dmp

      Filesize

      2.8MB