bdc709694217d752a2d80c71ca3976ef60af24a037b7ee48f5aa363740dbab05 | Triage

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 13:51

Sharing

Report Analysis Logs

General

Target

23362bd82f2b728d9fa29aacb6cc5f63.exe
Size

60KB
MD5

23362bd82f2b728d9fa29aacb6cc5f63
SHA1

8bfc38d809b223e6bce18598a574ded14d1e1fef
SHA256

bdc709694217d752a2d80c71ca3976ef60af24a037b7ee48f5aa363740dbab05
SHA512

da1acdab0f4298949cf71830113ca73fbd54713d25e8ad71d797a7cd4f0190540d3e1ca9715b949fcb35d6aca9ce42615ea16ec85dd767ff0ef69d051c84b9f6
SSDEEP

1536:eH7m1pcTY+rcKN2rnobvXWjy2rZDVmYtLYS:MOy2rhVV

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 1304	1016	23362bd82f2b728d9fa29aacb6cc5f63.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4844	1304	WerFault.exe	87

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1304	1016	23362bd82f2b728d9fa29aacb6cc5f63.exe	87
PID 1016 wrote to memory of 1304	1016	23362bd82f2b728d9fa29aacb6cc5f63.exe	87
PID 1016 wrote to memory of 1304	1016	23362bd82f2b728d9fa29aacb6cc5f63.exe	87
PID 1016 wrote to memory of 1304	1016	23362bd82f2b728d9fa29aacb6cc5f63.exe	87
PID 1016 wrote to memory of 1304	1016	23362bd82f2b728d9fa29aacb6cc5f63.exe	87

C:\Users\Admin\AppData\Local\Temp\23362bd82f2b728d9fa29aacb6cc5f63.exe
"C:\Users\Admin\AppData\Local\Temp\23362bd82f2b728d9fa29aacb6cc5f63.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\23362bd82f2b728d9fa29aacb6cc5f63.exe
  "C:\Users\Admin\AppData\Local\Temp\23362bd82f2b728d9fa29aacb6cc5f63.exe"
  2⤵
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 12
    3⤵
    - Program crash
    PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1304 -ip 1304
1⤵
PID:376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-0-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/1016-2-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/1304-1-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download