Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4964bc5e5b2066b0e42b99c026fc6f24.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4964bc5e5b2066b0e42b99c026fc6f24.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
4964bc5e5b2066b0e42b99c026fc6f24.exe
-
Size
148KB
-
MD5
4964bc5e5b2066b0e42b99c026fc6f24
-
SHA1
7040acdbfd2b3752992764cc72f7d02971b932a8
-
SHA256
f11b599236882cd5c711b416384a00f573e0ffb1186e59c1a231731bf5339d9b
-
SHA512
9df907f12003f8f85b54162f1a624a5ca2edda268cd4dddc6950099dff7c9e052ca7ddacb49425ddc676c0eaad99bbce992a6d0abb569a77fff0f03e4559b70f
-
SSDEEP
1536:7tWP41C/7tfteeRXoJ9zoWzH0sUzZhyFBndTX7EtWAfFE4G:7tX1C/7tfE+oJxo2HDkKFrmWAjG
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2548 set thread context of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94 -
Program crash 2 IoCs
pid pid_target Process procid_target 4108 4960 WerFault.exe 1332 4960 WerFault.exe 94 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2548 wrote to memory of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94 PID 2548 wrote to memory of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94 PID 2548 wrote to memory of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94 PID 2548 wrote to memory of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94 PID 2548 wrote to memory of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94 PID 2548 wrote to memory of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94 PID 2548 wrote to memory of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94 PID 2548 wrote to memory of 4960 2548 4964bc5e5b2066b0e42b99c026fc6f24.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\4964bc5e5b2066b0e42b99c026fc6f24.exe"C:\Users\Admin\AppData\Local\Temp\4964bc5e5b2066b0e42b99c026fc6f24.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\4964bc5e5b2066b0e42b99c026fc6f24.exeC:\Users\Admin\AppData\Local\Temp\\\\\\\4964bc5e5b2066b0e42b99c026fc6f24.exe2⤵PID:4960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1923⤵
- Program crash
PID:1332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 1881⤵
- Program crash
PID:4108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4960 -ip 49601⤵PID:2632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4960 -ip 49601⤵PID:3956