21e9f6c42515856dd1cd22040873c9d04694840fbc2204c5a2f26f609b33a475 | Triage

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

14ff5643321afaab7c012d46e82c8f60.exe
Size

44KB
MD5

14ff5643321afaab7c012d46e82c8f60
SHA1

08859eac1cb9433c4d4f468b97da00e031ee43f5
SHA256

21e9f6c42515856dd1cd22040873c9d04694840fbc2204c5a2f26f609b33a475
SHA512

86999147a5bfb4e6261d4e43e9f85739b56dcb1dfa8615e4d4105f9f970effe7b048839219eae92ecaa1159cab0c7dc774758befb7673f05a48e268691aec74d
SSDEEP

768:OJd55lG2Y67djNpE1F6krVO9E5htmqI1X1MyK4V:Ox5U2dUb6krVOGUqIx5V

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4152 set thread context of 2044	4152	14ff5643321afaab7c012d46e82c8f60.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
548	2044	WerFault.exe	91

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4152	14ff5643321afaab7c012d46e82c8f60.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 2044	4152	14ff5643321afaab7c012d46e82c8f60.exe	91
PID 4152 wrote to memory of 2044	4152	14ff5643321afaab7c012d46e82c8f60.exe	91
PID 4152 wrote to memory of 2044	4152	14ff5643321afaab7c012d46e82c8f60.exe	91
PID 4152 wrote to memory of 2044	4152	14ff5643321afaab7c012d46e82c8f60.exe	91
PID 4152 wrote to memory of 2044	4152	14ff5643321afaab7c012d46e82c8f60.exe	91
PID 4152 wrote to memory of 2044	4152	14ff5643321afaab7c012d46e82c8f60.exe	91
PID 4152 wrote to memory of 2044	4152	14ff5643321afaab7c012d46e82c8f60.exe	91

C:\Users\Admin\AppData\Local\Temp\14ff5643321afaab7c012d46e82c8f60.exe
"C:\Users\Admin\AppData\Local\Temp\14ff5643321afaab7c012d46e82c8f60.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Local\Temp\14ff5643321afaab7c012d46e82c8f60.exe
  C:\Users\Admin\AppData\Local\Temp\14ff5643321afaab7c012d46e82c8f60.exe
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 460
    3⤵
    - Program crash
    PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2044 -ip 2044
1⤵
PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-2-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2044-3-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2044-6-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download