Analysis
-
max time kernel
134s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
24/12/2023, 14:57
General
-
Target
02900b611d0150723cbb419d2348bc08.exe
-
Size
552KB
-
MD5
02900b611d0150723cbb419d2348bc08
-
SHA1
5fc57e968a282d1d16dc84c4a12e1ac50a08f7b9
-
SHA256
e487138bfd41bb305ac575c6389814cae8f2759a1fed265de8c8652038b06c9d
-
SHA512
7c08b1523c5dbb0c2e4faa81a64a579db0f60340952d2216def3b0716f8b8037dfa717ea7ab9ac2fbb52d9b84ff351bf9a7c88aaeecf17527489e8f5b58a4f2d
-
SSDEEP
12288:bm6wWFBM+afuThoPsCb4O6T7CTumzvfs5fk+CqtbwC:S6wKgm1+UTRmzvfs5f6qtk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02900b611d0150723cbb419d2348bc08.exe"C:\Users\Admin\AppData\Local\Temp\02900b611d0150723cbb419d2348bc08.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\1.exec:\1.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1640 -ip 16401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 2241⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD540a74eb6bf92ccd552609dbddf2f85af
SHA15ae91328af1772a16a065e189efea9547806ff02
SHA256ffa8ec07bcf40fcf8c3c308e5ba7878b1e36731378813de448cb42aa26fecf04
SHA512e37907463dffe44a9124305a491fb073cba1e0f35296c6d9af6aff72f4279c7cbc9f77c6b40b2567c676384bf8dee1b36541fc1a8344b7c515a42960e9443aeb
-
Filesize
1KB
MD513e4cfe1143930d1a83063a09cc9f37f
SHA1f85fa82195ceb9f5863cff342cee2d245add6978
SHA2564a857869f58f7fba8505d4a8484902932d2186ffdc2d9699a18bb9ae4062b85a
SHA512b24adc89f70e37cdded1f6169b1c527ab7d5c85c1851d974ec73d35e6d29f31898cc2c8dbaf56e0e8d40aa4d94bd303808f5a9c37a288b08da8226b5bb06f83e
-
Filesize
1.3MB