Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26/12/2023, 09:11
General
-
Target
629afba004fe74e6ee3e516ac682fc72.exe
-
Size
130KB
-
MD5
629afba004fe74e6ee3e516ac682fc72
-
SHA1
2f94283b4d3a34be163eff7e014138cc837653c7
-
SHA256
40c1157ad9a0346db675668701f5e6a76fbe3cd7ecc13bb11c9eb063fdd4febb
-
SHA512
8d71f796131d7091de492e2f11aff392ea883383aa8b7eb4ac3f019cc3fef5137e72aeadd7ac59adeb93cca794913b2138844fdebd3d161395884550b52851ed
-
SSDEEP
1536:biWSwRZ9TTxKzs+QES5f1gNMVAFn4EmC:zSwRDTtd+Q1F1AMVCn4Z
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\629afba004fe74e6ee3e516ac682fc72.exe"C:\Users\Admin\AppData\Local\Temp\629afba004fe74e6ee3e516ac682fc72.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\629afba004fe74e6ee3e516ac682fc72.exe"C:\Users\Admin\AppData\Local\Temp\629afba004fe74e6ee3e516ac682fc72.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 3683⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4064 -ip 40641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
152KB
-
Filesize
152KB