fb78db69fbea48aaea3b4c174c6435dd45a0aface9507bda3b8bdb2d760d3da7 | Triage

Analysis

max time kernel
179s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b6a21d4aa35b6734ba45ff9795a0dcd.exe
Size

24KB
MD5

3b6a21d4aa35b6734ba45ff9795a0dcd
SHA1

06861c0439f48f743eb094350fff330650292812
SHA256

fb78db69fbea48aaea3b4c174c6435dd45a0aface9507bda3b8bdb2d760d3da7
SHA512

46c285af1c634d005fc28f39834f6c01432fa8b3c14058101ecca362a3406c55401f7aa4d64bd1614c39a9b9dd50527770ce58b0427deb813c2ba6483168d9c7
SSDEEP

768:X9g6dm7aspuHdKmJpskIbBmZ9GM8QpuCmY:mqgO5SkIVmZ0ri

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3600 set thread context of 3716	3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe	92

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3292	3716	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe
3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe
3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe
3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 3716	3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe	92
PID 3600 wrote to memory of 3716	3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe	92
PID 3600 wrote to memory of 3716	3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe	92
PID 3600 wrote to memory of 3716	3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe	92
PID 3600 wrote to memory of 3716	3600	3b6a21d4aa35b6734ba45ff9795a0dcd.exe	92

C:\Users\Admin\AppData\Local\Temp\3b6a21d4aa35b6734ba45ff9795a0dcd.exe
"C:\Users\Admin\AppData\Local\Temp\3b6a21d4aa35b6734ba45ff9795a0dcd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\mspaint.exe
  C:\Users\Admin\AppData\Local\Temp\3b6a21d4aa35b6734ba45ff9795a0dcd.exe
  2⤵
  PID:3716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 12
    3⤵
    - Program crash
    PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3716 -ip 3716
1⤵
PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download