Analysis

  • max time kernel
    86s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2023, 22:57

General

  • Target

    d06e8f2049954fdbf587cd01be26a51e113af30541357acec590ab2dfbef34cb.exe

  • Size

    969KB

  • MD5

    71260663602d3050a9eec59c2ced1d2b

  • SHA1

    530e9698cf2546cc4ba5c507623ddae981104fa9

  • SHA256

    d06e8f2049954fdbf587cd01be26a51e113af30541357acec590ab2dfbef34cb

  • SHA512

    e3116df17e5d6e2bb4cdb137994bc9a5a78944d791726b931eb6ec4f89cb04fbfb2b91174632e52c8cf91ba1bde079bfc731bb52e0e162f582fbd6f956157315

  • SSDEEP

    24576:ZkAs+akOyXwfTTAsOY7DxIt1kEaHNYK3Y1ZOeQqLIOh:OAsB1lTpOY7tIt1NagPQEfh

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d06e8f2049954fdbf587cd01be26a51e113af30541357acec590ab2dfbef34cb.exe
    "C:\Users\Admin\AppData\Local\Temp\d06e8f2049954fdbf587cd01be26a51e113af30541357acec590ab2dfbef34cb.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 760
      2⤵
      • Program crash
      PID:2352
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4624 -ip 4624
    1⤵
      PID:744

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4624-0-0x0000000000400000-0x0000000000A15000-memory.dmp

      Filesize

      6.1MB

    • memory/4624-1-0x00000000029A0000-0x0000000002A00000-memory.dmp

      Filesize

      384KB

    • memory/4624-2-0x0000000003430000-0x0000000003431000-memory.dmp

      Filesize

      4KB

    • memory/4624-3-0x0000000003440000-0x0000000003441000-memory.dmp

      Filesize

      4KB

    • memory/4624-4-0x0000000002980000-0x0000000002981000-memory.dmp

      Filesize

      4KB

    • memory/4624-5-0x0000000003460000-0x0000000003461000-memory.dmp

      Filesize

      4KB

    • memory/4624-6-0x0000000003420000-0x0000000003421000-memory.dmp

      Filesize

      4KB

    • memory/4624-7-0x0000000002A00000-0x0000000002A01000-memory.dmp

      Filesize

      4KB

    • memory/4624-8-0x0000000003480000-0x0000000003481000-memory.dmp

      Filesize

      4KB

    • memory/4624-9-0x00000000043F0000-0x00000000043F1000-memory.dmp

      Filesize

      4KB

    • memory/4624-10-0x0000000003450000-0x0000000003451000-memory.dmp

      Filesize

      4KB

    • memory/4624-11-0x00000000043E0000-0x00000000043E4000-memory.dmp

      Filesize

      16KB

    • memory/4624-13-0x0000000003500000-0x0000000003501000-memory.dmp

      Filesize

      4KB

    • memory/4624-12-0x00000000034F0000-0x00000000034F1000-memory.dmp

      Filesize

      4KB

    • memory/4624-15-0x00000000034D0000-0x00000000034D1000-memory.dmp

      Filesize

      4KB

    • memory/4624-14-0x00000000034B0000-0x00000000034B1000-memory.dmp

      Filesize

      4KB

    • memory/4624-16-0x0000000003520000-0x0000000003521000-memory.dmp

      Filesize

      4KB

    • memory/4624-18-0x00000000035A0000-0x00000000035A1000-memory.dmp

      Filesize

      4KB

    • memory/4624-19-0x00000000035B0000-0x00000000035B1000-memory.dmp

      Filesize

      4KB

    • memory/4624-17-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/4624-21-0x0000000003590000-0x0000000003591000-memory.dmp

      Filesize

      4KB

    • memory/4624-22-0x0000000003580000-0x0000000003581000-memory.dmp

      Filesize

      4KB

    • memory/4624-20-0x0000000003560000-0x0000000003561000-memory.dmp

      Filesize

      4KB

    • memory/4624-23-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/4624-24-0x0000000004430000-0x0000000004431000-memory.dmp

      Filesize

      4KB

    • memory/4624-26-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

      Filesize

      4KB

    • memory/4624-25-0x0000000003490000-0x0000000003491000-memory.dmp

      Filesize

      4KB

    • memory/4624-27-0x0000000001080000-0x0000000001081000-memory.dmp

      Filesize

      4KB

    • memory/4624-28-0x0000000004400000-0x0000000004401000-memory.dmp

      Filesize

      4KB

    • memory/4624-29-0x0000000003550000-0x0000000003551000-memory.dmp

      Filesize

      4KB

    • memory/4624-30-0x00000000036B0000-0x00000000036B1000-memory.dmp

      Filesize

      4KB

    • memory/4624-31-0x0000000003600000-0x0000000003601000-memory.dmp

      Filesize

      4KB

    • memory/4624-33-0x0000000004450000-0x0000000004451000-memory.dmp

      Filesize

      4KB

    • memory/4624-32-0x0000000003760000-0x0000000003761000-memory.dmp

      Filesize

      4KB

    • memory/4624-34-0x0000000004440000-0x0000000004441000-memory.dmp

      Filesize

      4KB

    • memory/4624-35-0x00000000045B0000-0x00000000045B1000-memory.dmp

      Filesize

      4KB

    • memory/4624-36-0x00000000045A0000-0x00000000045A1000-memory.dmp

      Filesize

      4KB

    • memory/4624-37-0x00000000045D0000-0x00000000045D1000-memory.dmp

      Filesize

      4KB

    • memory/4624-38-0x00000000045C0000-0x00000000045C1000-memory.dmp

      Filesize

      4KB

    • memory/4624-39-0x0000000000400000-0x0000000000A15000-memory.dmp

      Filesize

      6.1MB

    • memory/4624-40-0x00000000029A0000-0x0000000002A00000-memory.dmp

      Filesize

      384KB