Analysis

  • max time kernel
    146s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 02:19

General

  • Target

    0b6fd9f0eda46983a5df44c086e9f073.exe

  • Size

    1.2MB

  • MD5

    0b6fd9f0eda46983a5df44c086e9f073

  • SHA1

    65e9a9a2a550d30cc497686a7c17900576b0a501

  • SHA256

    3f7ef3fcc9141ed9a7d7620c90325356956947add46038ece8167d8c5028273e

  • SHA512

    a32fd364fc804c4275dc5f641e355d4dfd481336a4e67791437941a1c599d55c15b4707149d283e2b86bb502c652c3707c6df67256a353f96632b3e02656f747

  • SSDEEP

    24576:YNC4WivbbYqTkj7wtLCeEIOfN4wZvK7G2SLlZ8dwkVGDs09du:MRvbbYqYj7QCeXyKyK7G2SsuMGDlG

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b6fd9f0eda46983a5df44c086e9f073.exe
    "C:\Users\Admin\AppData\Local\Temp\0b6fd9f0eda46983a5df44c086e9f073.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\0B6FD9~1.TMP,S C:\Users\Admin\AppData\Local\Temp\0B6FD9~1.EXE
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      PID:628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 492
      2⤵
      • Program crash
      PID:3488
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4976 -ip 4976
    1⤵
      PID:4768

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\0B6FD9~1.EXE.tmp

      Filesize

      12KB

      MD5

      41cb9e4d9a1126525a6ecd62435362a4

      SHA1

      22b380da6d27aca1d7665b10ce8d469d68d57b19

      SHA256

      778a6b29042ca4279b0b49ee6e128d586f567acfa003b9f144b276ceccdec3a4

      SHA512

      1807ce7d4e5e5ea6057b603f6a662f11bbc14a054644efccadd07744894ea2039a077faa3653a129e738ee5d6023805a3dc164558b740d49f27561ace92c4f1e

    • C:\Users\Admin\AppData\Local\Temp\0B6FD9~1.TMP

      Filesize

      28KB

      MD5

      9c4e443e2dba7f70ecccae301eae8767

      SHA1

      a290ed23c9822b10e8a7ed76a4aa20208e2224bd

      SHA256

      da41b5c51d7afff773ccd16bbbb80180bf4cd848260da0fc410ce948ac8b40a6

      SHA512

      b81f98bf5064b68988e33d70e058ce751dc5503335714090b0f355be524b101add5fd03fff68eebbe6743f7e7f1128deffd40acee96c2c5279f936dc903da7d4

    • memory/628-18-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/628-22-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/628-25-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/628-24-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/628-23-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/628-10-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/628-21-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/628-19-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/628-20-0x0000000000400000-0x000000000055C000-memory.dmp

      Filesize

      1.4MB

    • memory/4976-1-0x0000000000B20000-0x0000000000C10000-memory.dmp

      Filesize

      960KB

    • memory/4976-3-0x0000000000400000-0x00000000009DF000-memory.dmp

      Filesize

      5.9MB

    • memory/4976-8-0x0000000000400000-0x00000000009DF000-memory.dmp

      Filesize

      5.9MB

    • memory/4976-9-0x0000000000DD0000-0x0000000000ECF000-memory.dmp

      Filesize

      1020KB

    • memory/4976-2-0x0000000000DD0000-0x0000000000ECF000-memory.dmp

      Filesize

      1020KB