fe11e9a33d38be450c6e95a499233defd67de8e47d17276316697bde27e6bfcf | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2023 05:04

Sharing

Report Analysis Logs

General

Target

HS_ZHY.exe
Size

12.6MB
MD5

2b4e00f7fb80e9e56ded649cfc61ab55
SHA1

ed513ba445807335eb730fbe724cd38062540803
SHA256

cc1b10edd9b101cae0bc9788aaf185d890b0a3c0f2113d7bf739bc456c12eeeb
SHA512

9e9551478491fbdf13556cc426910ef52f8575d8243f940f3eb34684d00ae9a765dbf8854edaf718ac5719d378a3014ade9106d743360906fc51cec1206269e9
SSDEEP

196608:VUBVvcLcLcLcbcXE/JgfmA/STG5555LsjwfP:VUBFcLcLcLcbc4gfkTG5555LsEf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4328 1408 WerFault.exe HS_ZHY.exe

C:\Users\Admin\AppData\Local\Temp\HS_ZHY.exe
"C:\Users\Admin\AppData\Local\Temp\HS_ZHY.exe"
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 824
2⤵
- Program crash
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1408 -ip 1408
1⤵
PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-0-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/1408-1-0x0000000000E90000-0x0000000001B36000-memory.dmp

Filesize
12.6MB

Download
memory/1408-2-0x0000000006A70000-0x0000000007014000-memory.dmp

Filesize
5.6MB

Download
memory/1408-3-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download