6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c | Triage

Resubmissions

26-09-2023 23:32

230926-3jmwysec2t 10

26-09-2023 19:57

230926-ypd4sadc8z 3

26-09-2023 07:46

230926-jly78afe7v 5

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2023 19:57

Sharing

Report Analysis Logs

General

Target

eee.exe
Size

447KB
MD5

89f71046c8298c6ef2db92fe202f9b43
SHA1

1fad31eedaa7437e96f9a13f60e85c1d14afa08f
SHA256

6a096c8158da4e2453ba68fe0f780c2e4181c01f125d7831fc5d58a77faf792c
SHA512

972abc83a524cca9ac8c326c2d4e8cc49f4b877965ba6bce941b7a1b13ae7fd4306cffdb63e1bcbede44aca7a515a13d67db77045e502e8424e9d7d95e95a2d4
SSDEEP

6144:PW/OU+cR2lBLVa8MK1hmcRwpq/JiTTUh/:eR2jLt1hmcRwpq/JiTTUh/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3504	3304	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3304	eee.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4672	3304	eee.exe	85
PID 3304 wrote to memory of 4672	3304	eee.exe	85
PID 3304 wrote to memory of 4672	3304	eee.exe	85

C:\Users\Admin\AppData\Local\Temp\eee.exe
"C:\Users\Admin\AppData\Local\Temp\eee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  PID:4672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 708
  2⤵
  - Program crash
  PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3304 -ip 3304
1⤵
PID:5036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3304-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3304-2-0x0000000076970000-0x0000000076A2F000-memory.dmp

Filesize
764KB

Download
memory/3304-3-0x0000000076970000-0x0000000076A2F000-memory.dmp

Filesize
764KB

Download