2ce3102349fb2fd94cc42b62266deb8cbdd575cbe1d0eb8ea74f2be71056ceac | Triage

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1e5aba765b4cab5fcdbf84283526734e.exe
Size

32KB
MD5

1e5aba765b4cab5fcdbf84283526734e
SHA1

3bc8ad59c372f022a1591cce108e5666d1fbd516
SHA256

2ce3102349fb2fd94cc42b62266deb8cbdd575cbe1d0eb8ea74f2be71056ceac
SHA512

8266e1649a3ecf4131d98bab184ac83fe321f663af14c6f848f368f9d8b447af1d9e85d93b1f5ac73ebecb9b10df0f1fed0aef50d9d91ca5ccd9ebabf4ce3f12
SSDEEP

768:t+JS71pvXry+vvYgDGoB+Uu0jCJDKV72pa1BLT:ooD2aYWvl7v3T

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 404 set thread context of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	3268	WerFault.exe	28

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3268	1e5aba765b4cab5fcdbf84283526734e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28
PID 404 wrote to memory of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28
PID 404 wrote to memory of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28
PID 404 wrote to memory of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28
PID 404 wrote to memory of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28
PID 404 wrote to memory of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28
PID 404 wrote to memory of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28
PID 404 wrote to memory of 3268	404	1e5aba765b4cab5fcdbf84283526734e.exe	28

C:\Users\Admin\AppData\Local\Temp\1e5aba765b4cab5fcdbf84283526734e.exe
"C:\Users\Admin\AppData\Local\Temp\1e5aba765b4cab5fcdbf84283526734e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\1e5aba765b4cab5fcdbf84283526734e.exe
  "C:\Users\Admin\AppData\Local\Temp\1e5aba765b4cab5fcdbf84283526734e.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:3268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 12
    3⤵
    - Program crash
    PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3268 -ip 3268
1⤵
PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/404-4-0x0000000000010000-0x000000000001F000-memory.dmp

Filesize
60KB

Download
memory/3268-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3268-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3268-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download