Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2023 18:36

General

  • Target

    00a21af86d5da941917113d74048f7bd.exe

  • Size

    600KB

  • MD5

    00a21af86d5da941917113d74048f7bd

  • SHA1

    25787e9f0d8515f186fd12be37407f5b1346f807

  • SHA256

    f1bbeac2c4f72c4f64eda5a4c954f968fe3376f6db60a0beccc551c32b400e08

  • SHA512

    0fb5ebbc37d753672e7e6b3b99022970fafa3513e965222ea25ea0127513964e39d336b08ccea6f15e71915f397b6f22e8bd408fc8567ccb077302fcd7c71308

  • SSDEEP

    12288:c09L58wWbYUB+G2eSpxkCqm6CF3Z4mxxl5iEha7jk97dUB:cO8X/fSimpQmX+Ehha

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00a21af86d5da941917113d74048f7bd.exe
    "C:\Users\Admin\AppData\Local\Temp\00a21af86d5da941917113d74048f7bd.exe"
    1⤵
      PID:5088
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 472
        2⤵
        • Program crash
        PID:4652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5088 -ip 5088
      1⤵
        PID:5028

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5088-0-0x0000000000400000-0x00000000004AB000-memory.dmp

        Filesize

        684KB

      • memory/5088-1-0x0000000002270000-0x00000000022C4000-memory.dmp

        Filesize

        336KB

      • memory/5088-4-0x0000000002500000-0x0000000002501000-memory.dmp

        Filesize

        4KB

      • memory/5088-5-0x0000000002480000-0x0000000002481000-memory.dmp

        Filesize

        4KB

      • memory/5088-10-0x0000000002490000-0x0000000002491000-memory.dmp

        Filesize

        4KB

      • memory/5088-12-0x0000000003460000-0x0000000003462000-memory.dmp

        Filesize

        8KB

      • memory/5088-11-0x0000000003470000-0x0000000003471000-memory.dmp

        Filesize

        4KB

      • memory/5088-9-0x0000000002510000-0x0000000002511000-memory.dmp

        Filesize

        4KB

      • memory/5088-8-0x00000000024E0000-0x00000000024E1000-memory.dmp

        Filesize

        4KB

      • memory/5088-7-0x00000000024F0000-0x00000000024F1000-memory.dmp

        Filesize

        4KB

      • memory/5088-6-0x0000000002470000-0x0000000002471000-memory.dmp

        Filesize

        4KB

      • memory/5088-3-0x00000000024A0000-0x00000000024A1000-memory.dmp

        Filesize

        4KB

      • memory/5088-2-0x00000000024D0000-0x00000000024D1000-memory.dmp

        Filesize

        4KB

      • memory/5088-13-0x0000000000400000-0x00000000004AB000-memory.dmp

        Filesize

        684KB

      • memory/5088-16-0x0000000002270000-0x00000000022C4000-memory.dmp

        Filesize

        336KB