05b7654444d53fbda164a776d797ea61c288213cc4183d80d82334e73b25a6ac

Analysis

max time kernel
122s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07071d1c32452235314c222294071370.exe
Size

1.5MB
MD5

07071d1c32452235314c222294071370
SHA1

9f4ea1773e71eff809b78643c49222c1ebfaf545
SHA256

05b7654444d53fbda164a776d797ea61c288213cc4183d80d82334e73b25a6ac
SHA512

acc9fa8da2d3114589abd2b1ccb515afab9aadb673115002e3c09cd8cec3bd35b64fea72be7b691a1238c3c0aee8e203a16dedad3150c79052c51f808c861a6b
SSDEEP

24576:q+k54ErHOGNEwlQCJpMDQkwd8kamv2afOht5OZ6fgL7uupy6q9VC:eaErHHNHQC6Qv8imht587n3cA

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2776	07071d1c32452235314c222294071370.exe
2776	07071d1c32452235314c222294071370.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2776	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2776	07071d1c32452235314c222294071370.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2776	07071d1c32452235314c222294071370.exe
2776	07071d1c32452235314c222294071370.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2224	2776	07071d1c32452235314c222294071370.exe	29
PID 2776 wrote to memory of 2224	2776	07071d1c32452235314c222294071370.exe	29
PID 2776 wrote to memory of 2224	2776	07071d1c32452235314c222294071370.exe	29
PID 2776 wrote to memory of 2224	2776	07071d1c32452235314c222294071370.exe	29

C:\Users\Admin\AppData\Local\Temp\07071d1c32452235314c222294071370.exe
"C:\Users\Admin\AppData\Local\Temp\07071d1c32452235314c222294071370.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 344
  2⤵
  - Program crash
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-0-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download
memory/2776-1-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-3-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-5-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-16-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-20-0x0000000076EBF000-0x0000000076EC0000-memory.dmp

Filesize
4KB

Download
memory/2776-21-0x0000000076EC0000-0x0000000076EC1000-memory.dmp

Filesize
4KB

Download
memory/2776-18-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download
memory/2776-14-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-23-0x00000000007F0000-0x0000000000834000-memory.dmp

Filesize
272KB

Download
memory/2776-28-0x00000000007F0000-0x0000000000834000-memory.dmp

Filesize
272KB

Download
memory/2776-22-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-12-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-10-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-8-0x0000000077030000-0x0000000077031000-memory.dmp

Filesize
4KB

Download
memory/2776-6-0x0000000076EBF000-0x0000000076EC0000-memory.dmp

Filesize
4KB

Download
memory/2776-29-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download