598b863b03ee4133545a4a978bb2c37b121f6e1120e17292c0b315546b13ea32 | Triage

Analysis

max time kernel
174s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 07:04

Sharing

Report Analysis Logs

General

Target

Fix.exe
Size

379KB
MD5

52e507f8cbdf95493c5963ddba10968e
SHA1

765adfb02b9f0d6e814051d07c5b324c3b7a2d92
SHA256

598b863b03ee4133545a4a978bb2c37b121f6e1120e17292c0b315546b13ea32
SHA512

c4e9ed01f38fa3b7027d10739bb99debcc75f7a8a3f57cb786d3350974f971579ccbf7627a3bda6ab417d1eed84dc89c52e1677d91fab497c484fd89e3d2da3d
SSDEEP

6144:EJbuFHgEq3nAE/aEaJdebAIpG65X2JYNjyHWDbuIlsMFP:3FA5vaEaJdebAvYNj2cVlsMh

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5108 created 3180	5108	Fix.exe	43

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5108	Fix.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3180
- C:\Users\Admin\AppData\Local\Temp\Fix.exe
  "C:\Users\Admin\AppData\Local\Temp\Fix.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5108 -ip 5108
1⤵
PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5108-0-0x0000000000B50000-0x0000000000BB5000-memory.dmp

Filesize
404KB

Download
memory/5108-2-0x00000000767E0000-0x000000007689F000-memory.dmp

Filesize
764KB

Download
memory/5108-6-0x00000000767E0000-0x000000007689F000-memory.dmp

Filesize
764KB

Download