Analysis
- max time kernel
90s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
24/12/2023, 17:29
General
- Target 088b6125380f18baf1896ee420e00561.exe
- Size 152KB
- Sample231224-v2k63sbfc6
- SHA256 c6e7117832118f0a7c47cf7577553bdb879cb479c9f4d37874024820b59da89d
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\088b6125380f18baf1896ee420e00561.exe"C:\Users\Admin\AppData\Local\Temp\088b6125380f18baf1896ee420e00561.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\088b6125380f18baf1896ee420e00561.exeC:\Users\Admin\AppData\Local\Temp\088b6125380f18baf1896ee420e00561.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4784 -ip 47841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 4601⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2104-10-0x00000000775B3000-0x00000000775B4000-memory.dmp
memory/2104-5-0x00000000775B2000-0x00000000775B3000-memory.dmp
memory/2104-18-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2104-20-0x00000000021B0000-0x00000000021E9000-memory.dmp
memory/2104-19-0x00000000773E0000-0x00000000774D0000-memory.dmp
memory/2104-0-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2104-1-0x0000000002170000-0x0000000002174000-memory.dmp
memory/2104-12-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2104-11-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2104-8-0x00000000775A3000-0x00000000775A4000-memory.dmp
memory/2104-9-0x0000000002210000-0x0000000002220000-memory.dmp
memory/2104-7-0x00000000773E0000-0x00000000774D0000-memory.dmp
memory/2104-6-0x00000000022C0000-0x00000000022D0000-memory.dmp
memory/2104-4-0x0000000002340000-0x0000000002350000-memory.dmp
memory/2104-3-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2104-2-0x00000000021B0000-0x00000000021E9000-memory.dmp
memory/4784-15-0x0000000000400000-0x0000000000402000-memory.dmp
memory/4784-17-0x0000000000400000-0x0000000000402000-memory.dmp