ae8a1c7eb64c42ea2a04f97523ebf0844c27029eb040d910048b680f884b9dce | Triage

Analysis

max time kernel
87s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 22:26

Sharing

Report Analysis Logs

General

Target

Lab03-03.exe
Size

52KB
MD5

e2bf42217a67e46433da8b6f4507219e
SHA1

daf263702f11dc0430d30f9bf443e7885cf91fcb
SHA256

ae8a1c7eb64c42ea2a04f97523ebf0844c27029eb040d910048b680f884b9dce
SHA512

827ce1460954d1d75f66cee11e0277e295aa6a4b4e6ac2f2f5f20ef2107dbe6dcfa0cb771fb9dd75e4157bd4830fd82ed719732a6318e7f48172ae4342391d6d
SSDEEP

384:WFVmdLgy5rg8g3SRrmlmwTwJrgmoS+GFbenP56cbwRG10IOp2n40iFLcH:GX4g8LRjhgmoDGFyP3+zb4nGY

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3608 set thread context of 1668	3608	Lab03-03.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5084	1668	WerFault.exe	89

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1668	3608	Lab03-03.exe	89
PID 3608 wrote to memory of 1668	3608	Lab03-03.exe	89
PID 3608 wrote to memory of 1668	3608	Lab03-03.exe	89
PID 3608 wrote to memory of 1668	3608	Lab03-03.exe	89
PID 3608 wrote to memory of 1668	3608	Lab03-03.exe	89
PID 3608 wrote to memory of 1668	3608	Lab03-03.exe	89
PID 3608 wrote to memory of 1668	3608	Lab03-03.exe	89
PID 3608 wrote to memory of 1668	3608	Lab03-03.exe	89

C:\Users\Admin\AppData\Local\Temp\Lab03-03.exe
"C:\Users\Admin\AppData\Local\Temp\Lab03-03.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:1668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 12
    3⤵
    - Program crash
    PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1668 -ip 1668
1⤵
PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download