fe8e8580353214c96f7f57428cb8c8fcb856506d38ce0542ddc6eac7a47694ce

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba03a094584cd076ee9cecc2f6a29b6.exe
Size

643KB
MD5

0ba03a094584cd076ee9cecc2f6a29b6
SHA1

b1871cc34c92684859c849af903cf77e6325fd53
SHA256

fe8e8580353214c96f7f57428cb8c8fcb856506d38ce0542ddc6eac7a47694ce
SHA512

9eb3cec487bed5faa9478c8b22a8052aef98627cb3a3939d8f7bf7d1a3dc02d69f95be3902661ddc24c81f64ed13add79ea6dbf950156682c6eb70cbc3e30eb8
SSDEEP

12288:MUwvxAwA5TX8pdKiO7F3Z4mxxTC5pgMFWYX:MUwvxAwA5TsO7QmXmDNWYX

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FieleWay.txt	0ba03a094584cd076ee9cecc2f6a29b6.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2988	WerFault.exe	1

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2924	2988	0ba03a094584cd076ee9cecc2f6a29b6.exe	17
PID 2988 wrote to memory of 2924	2988	0ba03a094584cd076ee9cecc2f6a29b6.exe	17
PID 2988 wrote to memory of 2924	2988	0ba03a094584cd076ee9cecc2f6a29b6.exe	17
PID 2988 wrote to memory of 2924	2988	0ba03a094584cd076ee9cecc2f6a29b6.exe	17
PID 2988 wrote to memory of 2972	2988	0ba03a094584cd076ee9cecc2f6a29b6.exe	16
PID 2988 wrote to memory of 2972	2988	0ba03a094584cd076ee9cecc2f6a29b6.exe	16
PID 2988 wrote to memory of 2972	2988	0ba03a094584cd076ee9cecc2f6a29b6.exe	16
PID 2988 wrote to memory of 2972	2988	0ba03a094584cd076ee9cecc2f6a29b6.exe	16

C:\Users\Admin\AppData\Local\Temp\0ba03a094584cd076ee9cecc2f6a29b6.exe
"C:\Users\Admin\AppData\Local\Temp\0ba03a094584cd076ee9cecc2f6a29b6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 312
  2⤵
  - Program crash
  PID:2972
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-1-0x0000000000580000-0x00000000005D4000-memory.dmp

Filesize
336KB

Download
memory/2988-25-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2988-64-0x0000000004600000-0x0000000004601000-memory.dmp

Filesize
4KB

Download
memory/2988-63-0x00000000045D0000-0x00000000045D1000-memory.dmp

Filesize
4KB

Download
memory/2988-62-0x00000000045E0000-0x00000000045E1000-memory.dmp

Filesize
4KB

Download
memory/2988-61-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/2988-60-0x0000000004590000-0x0000000004591000-memory.dmp

Filesize
4KB

Download
memory/2988-59-0x0000000003710000-0x0000000003711000-memory.dmp

Filesize
4KB

Download
memory/2988-58-0x0000000003720000-0x0000000003721000-memory.dmp

Filesize
4KB

Download
memory/2988-57-0x00000000036F0000-0x00000000036F1000-memory.dmp

Filesize
4KB

Download
memory/2988-56-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/2988-55-0x00000000036D0000-0x00000000036D1000-memory.dmp

Filesize
4KB

Download
memory/2988-54-0x00000000036E0000-0x00000000036E1000-memory.dmp

Filesize
4KB

Download
memory/2988-53-0x00000000036B0000-0x00000000036B1000-memory.dmp

Filesize
4KB

Download
memory/2988-52-0x00000000036C0000-0x00000000036C1000-memory.dmp

Filesize
4KB

Download
memory/2988-51-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/2988-50-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/2988-49-0x00000000036A0000-0x00000000036A1000-memory.dmp

Filesize
4KB

Download
memory/2988-48-0x0000000003660000-0x0000000003661000-memory.dmp

Filesize
4KB

Download
memory/2988-47-0x0000000003670000-0x0000000003671000-memory.dmp

Filesize
4KB

Download
memory/2988-46-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/2988-45-0x0000000003650000-0x0000000003651000-memory.dmp

Filesize
4KB

Download
memory/2988-44-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/2988-43-0x0000000003630000-0x0000000003631000-memory.dmp

Filesize
4KB

Download
memory/2988-42-0x0000000003600000-0x0000000003601000-memory.dmp

Filesize
4KB

Download
memory/2988-41-0x0000000003610000-0x0000000003611000-memory.dmp

Filesize
4KB

Download
memory/2988-40-0x00000000035E0000-0x00000000035E1000-memory.dmp

Filesize
4KB

Download
memory/2988-39-0x00000000035F0000-0x00000000035F1000-memory.dmp

Filesize
4KB

Download
memory/2988-38-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2988-37-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2988-36-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/2988-35-0x00000000035B0000-0x00000000035B1000-memory.dmp

Filesize
4KB

Download
memory/2988-34-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/2988-33-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/2988-32-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/2988-31-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/2988-30-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/2988-29-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/2988-28-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/2988-27-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/2988-26-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2988-24-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/2988-23-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/2988-22-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2988-21-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/2988-20-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/2988-19-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2988-18-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2988-17-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/2988-16-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2988-15-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/2988-14-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/2988-13-0x0000000003380000-0x0000000003383000-memory.dmp

Filesize
12KB

Download
memory/2988-12-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/2988-11-0x0000000001F80000-0x0000000001F81000-memory.dmp

Filesize
4KB

Download
memory/2988-10-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/2988-9-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/2988-8-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/2988-7-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/2988-6-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/2988-5-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/2988-4-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download
memory/2988-3-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/2988-0-0x0000000000400000-0x0000000000512000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads