7d137500a274748d55ca9cf78ef1d98e008b7aa5d2073504ca7206f9bd38066d

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bdb39697d2f77aee1dc1bb696c0476b.exe
Size

396KB
MD5

1bdb39697d2f77aee1dc1bb696c0476b
SHA1

0f00c431b62d45921efd5fabcecea67fbd7a3f7f
SHA256

7d137500a274748d55ca9cf78ef1d98e008b7aa5d2073504ca7206f9bd38066d
SHA512

e7cc35d069e7c2e191f7944da59f8e6922df51cace8685ac463f082074c42c47853d920e8565503b6a5572a156f2734b4008c43c5b6919544e8b007b4139e7a6
SSDEEP

12288:1IV8UtK0uIb4kTp6b7MP+Dd2Uq/S6b7MP+Dd2wj:mM0rHs7MP+h2UAD7MP+h2+

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2840	4796	WerFault.exe	88
4488	4796	WerFault.exe	88

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	1bdb39697d2f77aee1dc1bb696c0476b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	1bdb39697d2f77aee1dc1bb696c0476b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	1bdb39697d2f77aee1dc1bb696c0476b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 2840	4796	1bdb39697d2f77aee1dc1bb696c0476b.exe	97
PID 4796 wrote to memory of 2840	4796	1bdb39697d2f77aee1dc1bb696c0476b.exe	97
PID 4796 wrote to memory of 2840	4796	1bdb39697d2f77aee1dc1bb696c0476b.exe	97

C:\Users\Admin\AppData\Local\Temp\1bdb39697d2f77aee1dc1bb696c0476b.exe
"C:\Users\Admin\AppData\Local\Temp\1bdb39697d2f77aee1dc1bb696c0476b.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 472
  2⤵
  - Program crash
  PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 472
  2⤵
  - Program crash
  PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4796 -ip 4796
1⤵
PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4796-1-0x0000000002230000-0x0000000002260000-memory.dmp

Filesize
192KB

Download
memory/4796-2-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4796-3-0x0000000002210000-0x0000000002213000-memory.dmp

Filesize
12KB

Download
memory/4796-4-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/4796-5-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/4796-6-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/4796-7-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/4796-8-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/4796-9-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4796-10-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4796-11-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4796-12-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4796-13-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4796-14-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4796-15-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/4796-16-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4796-17-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4796-18-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/4796-20-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/4796-19-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4796-22-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4796-23-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/4796-21-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4796-24-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4796-26-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/4796-25-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/4796-27-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4796-29-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4796-28-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4796-30-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4796-31-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/4796-32-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4796-33-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4796-34-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/4796-35-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/4796-36-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/4796-37-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4796-39-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4796-40-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/4796-38-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/4796-41-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/4796-42-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/4796-43-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/4796-44-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/4796-45-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/4796-50-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/4796-49-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/4796-48-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/4796-47-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/4796-46-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/4796-51-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/4796-52-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/4796-53-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/4796-54-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/4796-55-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4796-56-0x0000000002230000-0x0000000002260000-memory.dmp

Filesize
192KB

Download
memory/4796-57-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4796-58-0x0000000002230000-0x0000000002260000-memory.dmp

Filesize
192KB

Download
memory/4796-59-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads