Overview

overview

7

Static

static

7

37726dcb30...a5.exe

windows7-x64

7

37726dcb30...a5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 13:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    37726dcb30279040139f10d32e16d6a5.exe

  • Size

    68KB

  • MD5

    37726dcb30279040139f10d32e16d6a5

  • SHA1

    3b3203faa8170f8d937e7c33fff7c14c066d77e4

  • SHA256

    9d781b9fe8a71b06ca841882cb795d425c305a985fde9b443b6698a57c953e4b

  • SHA512

    e298292ad1cbfd44eb1bcc093953cb18bf37a9de11bfc2a715e60162518b1f666285cbe1d967837de2ba9272641b3c94c0ea5a7ce2c3f21209b22bfc53843b21

  • SSDEEP

    768:lX7U0rm/hIVym94fLiU+fc8ZcnrxWgnwFTLxuhH9Hg5+4MaMc3:pYs6Ilsixbq1Jn4Lg5dgN

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37726dcb30279040139f10d32e16d6a5.exe
    "C:\Users\Admin\AppData\Local\Temp\37726dcb30279040139f10d32e16d6a5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3796
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:4016
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 84
          3⤵
          • Program crash
          PID:2992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4016 -ip 4016
      1⤵
        PID:4840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 200
        1⤵
        • Program crash
        PID:4344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4016 -ip 4016
        1⤵
          PID:2804

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/3796-0-0x0000000000400000-0x0000000000412000-memory.dmp

                Filesize

                72KB

                Download

              • memory/3796-1-0x0000000000400000-0x0000000000412000-memory.dmp

                Filesize

                72KB

                Download

              • memory/4016-2-0x0000000000400000-0x0000000000412000-memory.dmp

                Filesize

                72KB

                Download