Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2023, 23:50

General

  • Target

    057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe

  • Size

    646KB

  • MD5

    d569c4642597d5b883b3ae598bcc19b3

  • SHA1

    7b8fa0006d9a7dc803eb1dd5c2ab2b4314942001

  • SHA256

    057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910

  • SHA512

    8dfb4d6280de31e2183a19ed790626485004d66a2b85d2dc3312b06a05cd47fe82add4e64d417709a38ea28ee7c3f0275af90fd1534857b5be643ea4d709ebe6

  • SSDEEP

    12288:3uP4KRi4cu659UrnsLoaEYkTOKKvnZzxoYYxj9eKjRKvYqg:iJRik65iwuYZ1oYgi1

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
    "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe
      "C:\Users\Admin\AppData\Local\Temp\057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 36
        3⤵
        • Program crash
        PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1180-0-0x0000000074D80000-0x000000007546E000-memory.dmp

    Filesize

    6.9MB

  • memory/1180-1-0x0000000000A80000-0x0000000000B28000-memory.dmp

    Filesize

    672KB

  • memory/1180-2-0x0000000004E90000-0x0000000004ED0000-memory.dmp

    Filesize

    256KB

  • memory/1180-3-0x0000000000310000-0x0000000000326000-memory.dmp

    Filesize

    88KB

  • memory/1180-4-0x0000000074D80000-0x000000007546E000-memory.dmp

    Filesize

    6.9MB

  • memory/1180-5-0x0000000000350000-0x000000000035A000-memory.dmp

    Filesize

    40KB

  • memory/1180-6-0x0000000005770000-0x00000000057EC000-memory.dmp

    Filesize

    496KB

  • memory/1180-12-0x0000000074D80000-0x000000007546E000-memory.dmp

    Filesize

    6.9MB

  • memory/2856-11-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2856-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2856-8-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2856-7-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2856-13-0x0000000000B30000-0x0000000000E33000-memory.dmp

    Filesize

    3.0MB

  • memory/2856-14-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB