2c8249b71e4e027717794e5ab0a27a8ce3ae3732e8de32a0d8e1b9acf2c73412

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6d09d484d7ccdad1c341eda09fe69026.exe
Size

247KB
MD5

6d09d484d7ccdad1c341eda09fe69026
SHA1

2ff7f3dec3de4edf9dc3a3453fdae689cc0ced01
SHA256

2c8249b71e4e027717794e5ab0a27a8ce3ae3732e8de32a0d8e1b9acf2c73412
SHA512

7b7c5d74fc1710f3bd8f888488337c51964bd9e6020c73ad12d7527d8d84174621b366eab899dc7deb8e385def5d3ee53f8af0099a3adc3727d756f6065c987c
SSDEEP

6144:nORGrsbX9LaO7KNGuTmEVmeM3E6Ygf4f+G:nOKea7LYP42

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2500	maxfilimg.exe

Loads dropped DLL 3 IoCs

pid	Process
2972	rundll32.exe
2972	rundll32.exe
2972	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	2972	WerFault.exe	89

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2500	4092	6d09d484d7ccdad1c341eda09fe69026.exe	88
PID 4092 wrote to memory of 2500	4092	6d09d484d7ccdad1c341eda09fe69026.exe	88
PID 4092 wrote to memory of 2500	4092	6d09d484d7ccdad1c341eda09fe69026.exe	88
PID 2500 wrote to memory of 2972	2500	maxfilimg.exe	89
PID 2500 wrote to memory of 2972	2500	maxfilimg.exe	89
PID 2500 wrote to memory of 2972	2500	maxfilimg.exe	89

C:\Users\Admin\AppData\Local\Temp\6d09d484d7ccdad1c341eda09fe69026.exe
"C:\Users\Admin\AppData\Local\Temp\6d09d484d7ccdad1c341eda09fe69026.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Roaming\maxfilimg\maxfilimg.exe
  C:\Users\Admin\AppData\Roaming\maxfilimg\maxfilimg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Roaming\MAXFIL~1\MAXFIL~1.DLL 000
    3⤵
    - Loads dropped DLL
    PID:2972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 744
      4⤵
      Program crash
      PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2972 -ip 2972
1⤵
PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MAXFIL~1\MAXFIL~1.DLL

Filesize
231KB

MD5
2c1df802c7e5babf835748b4184beea0

SHA1
422ef2500d614c11cc7bd666532dee6fa025301e

SHA256
fea3141b38fda4d0704bdabd76656087296efa04dba9c64ea3a7f4e41c9cc872

SHA512
3e6724391ecb89a98ef230ef313dfea951e3ccc16e77855f73f97afc486823ced10d9f337f3b3cd24145ea47ef31fab2ebdcbacab0761fbad5b5e66086dc243e

Download Submit
C:\Users\Admin\AppData\Roaming\maxfilimg\efopai.dll

Filesize
160KB

MD5
069b89e63681a1391e8f49d50867f049

SHA1
ec2787676bb27215992cd3dbc39ba5ed6d41026b

SHA256
756e1c0fd8e00159da74d7e482797b0dd0fc6371b5c38e398c3ffac6614b0c18

SHA512
0a9c8bf199bcf5a31b644350f89388547fa5c1a43d88aec8411a17ca7ce33ea86349803bc3c504df595b49a5c44f548febe7102965dcad5f0396ea209c2bdd6d

Download Submit
C:\Users\Admin\AppData\Roaming\maxfilimg\maxfilimg.exe

Filesize
247KB

MD5
6d09d484d7ccdad1c341eda09fe69026

SHA1
2ff7f3dec3de4edf9dc3a3453fdae689cc0ced01

SHA256
2c8249b71e4e027717794e5ab0a27a8ce3ae3732e8de32a0d8e1b9acf2c73412

SHA512
7b7c5d74fc1710f3bd8f888488337c51964bd9e6020c73ad12d7527d8d84174621b366eab899dc7deb8e385def5d3ee53f8af0099a3adc3727d756f6065c987c

Download Submit
memory/2500-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2972-25-0x0000000000B60000-0x0000000000B8A000-memory.dmp

Filesize
168KB

Download
memory/2972-29-0x0000000000B60000-0x0000000000B8A000-memory.dmp

Filesize
168KB

Download
memory/2972-33-0x0000000000B60000-0x0000000000B8A000-memory.dmp

Filesize
168KB

Download
memory/2972-32-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/2972-26-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/2972-15-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/2972-28-0x0000000000B60000-0x0000000000B8A000-memory.dmp

Filesize
168KB

Download
memory/2972-16-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/2972-31-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/2972-30-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/2972-17-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/4092-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4092-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4092-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4092-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads