7dd364cdda720841d650ddeb04c1be4b191f23b840cf7d34cadec70e1106ef74 | Triage

Analysis

max time kernel
110s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 11:01

Sharing

Report Analysis Logs

General

Target

1934bed7b582997888690eddd163ecf2.exe
Size

79KB
MD5

1934bed7b582997888690eddd163ecf2
SHA1

4b6447424beb1855ed0586af34f8168e6ff503dc
SHA256

7dd364cdda720841d650ddeb04c1be4b191f23b840cf7d34cadec70e1106ef74
SHA512

ebce312630af2b01c6f59d8234951f0f336aaa76cc565750f3ea3164f173095eb627c041a1895ee6958b900445c7ef888fcd08faf7013a8ba623fe42b5b66b57
SSDEEP

1536:cfYkpWncEVY+hRI3oyG3iEoWTb4cQHLEURBs37Gx:cnWckhRI3oyG3wm0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3448 set thread context of 116	3448	1934bed7b582997888690eddd163ecf2.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5036	116	WerFault.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3448	1934bed7b582997888690eddd163ecf2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 116	3448	1934bed7b582997888690eddd163ecf2.exe	86
PID 3448 wrote to memory of 116	3448	1934bed7b582997888690eddd163ecf2.exe	86
PID 3448 wrote to memory of 116	3448	1934bed7b582997888690eddd163ecf2.exe	86
PID 3448 wrote to memory of 116	3448	1934bed7b582997888690eddd163ecf2.exe	86
PID 3448 wrote to memory of 116	3448	1934bed7b582997888690eddd163ecf2.exe	86
PID 3448 wrote to memory of 116	3448	1934bed7b582997888690eddd163ecf2.exe	86
PID 3448 wrote to memory of 116	3448	1934bed7b582997888690eddd163ecf2.exe	86

C:\Users\Admin\AppData\Local\Temp\1934bed7b582997888690eddd163ecf2.exe
"C:\Users\Admin\AppData\Local\Temp\1934bed7b582997888690eddd163ecf2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\1934bed7b582997888690eddd163ecf2.exe
  C:\Users\Admin\AppData\Local\Temp\1934bed7b582997888690eddd163ecf2.exe
  2⤵
  PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 460
    3⤵
    - Program crash
    PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 116 -ip 116
1⤵
PID:4676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/116-3-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/116-5-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/116-6-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/116-7-0x0000000000400000-0x0000000000401C00-memory.dmp

Filesize
7KB

Download
memory/3448-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download