539296a080b0559058a49f701e2356d099b7eb155c78db554cafa4aba4247139 | Triage

Analysis

max time kernel
140s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ce8d41d4332d93a1b380662bb30e2d9.exe
Size

121KB
MD5

2ce8d41d4332d93a1b380662bb30e2d9
SHA1

a74408fddee2542d6effa1d0c1fcea29b94bf482
SHA256

539296a080b0559058a49f701e2356d099b7eb155c78db554cafa4aba4247139
SHA512

3eea5b0640d338200beed7d7a95fe099cfda700ac6c0551cd3824642ff0d32ee14b3aac9e196d01838e7a0e00290fccf3369873a0ef03842871b21fa06c10e5c
SSDEEP

3072:cN9FgZfY7fEsA5mJxGcXShSIY9G6EUCh4kAdEa:fZw7fEjUJxGz89G6EUChWD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
536	tmp.tmp.tmp1

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tmp.tmp.tmp1	2ce8d41d4332d93a1b380662bb30e2d9.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4664	536	WerFault.exe
3512	536	WerFault.exe	24

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1884	2ce8d41d4332d93a1b380662bb30e2d9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 536	1884	2ce8d41d4332d93a1b380662bb30e2d9.exe	24
PID 1884 wrote to memory of 536	1884	2ce8d41d4332d93a1b380662bb30e2d9.exe	24
PID 1884 wrote to memory of 536	1884	2ce8d41d4332d93a1b380662bb30e2d9.exe	24

C:\Users\Admin\AppData\Local\Temp\2ce8d41d4332d93a1b380662bb30e2d9.exe
"C:\Users\Admin\AppData\Local\Temp\2ce8d41d4332d93a1b380662bb30e2d9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\tmp.tmp.tmp1
  C:\Windows\tmp.tmp.tmp1
  2⤵
  - Executes dropped EXE
  PID:536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 316
    3⤵
    - Program crash
    PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 536 -ip 536
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 268
1⤵
- Program crash
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 536 -ip 536
1⤵
PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/536-10-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1884-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1884-11-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download