11a6a8183796f113d1b9a5e37389846d025cac3054825ac1d3ef4a38ad5e8577

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a5b44e559d8c5b6bf10512b037ac12b.exe
Size 755KB
Sample240108-eb9hzsaefm
SHA256 11a6a8183796f113d1b9a5e37389846d025cac3054825ac1d3ef4a38ad5e8577
MD5 4a5b44e559d8c5b6bf10512b037ac12b
SHA1 5f6863866991a9ecb29c8f7f96c61966e51ecd12
SHA512 1fa3657fc41fe409041a71b61638d6ca69d123602149a50932312a8c50b91cd816dcccfbbee77b03af81e7cd30796037eea72ad9cab48e9088bfac9e06c43940
SSDEEP 12288:oNhBJitWYoOOIpkYQJsYwA8/BLDjoFrxzebIz+WxxBVDGYP3IFJ:cBgcY8DlBODUzzEIdxxjDdP4FJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3096	setup.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2552	3096	WerFault.exe	89
2804	3096	WerFault.exe	89
1540	3096	WerFault.exe	89

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4640	4a5b44e559d8c5b6bf10512b037ac12b.exe
4640	4a5b44e559d8c5b6bf10512b037ac12b.exe
3096	setup.exe
3096	setup.exe
3096	setup.exe
3096	setup.exe
3096	setup.exe
3096	setup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3096	4640	4a5b44e559d8c5b6bf10512b037ac12b.exe	89
PID 4640 wrote to memory of 3096	4640	4a5b44e559d8c5b6bf10512b037ac12b.exe	89
PID 4640 wrote to memory of 3096	4640	4a5b44e559d8c5b6bf10512b037ac12b.exe	89

C:\Users\Admin\AppData\Local\Temp\4a5b44e559d8c5b6bf10512b037ac12b.exe
"C:\Users\Admin\AppData\Local\Temp\4a5b44e559d8c5b6bf10512b037ac12b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  C:\Users\Admin\AppData\Local\Temp\setup.exe relaunch
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 784
    3⤵
    - Program crash
    PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 1528
    3⤵
    - Program crash
    PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 708
    3⤵
    - Program crash
    PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 3096
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3096 -ip 3096
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3096 -ip 3096
1⤵
PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 241KB
SHA256 754826abd7f7aa24e13c60e7ba424d2308d2b0fb0352439dad624879ed5c6a60
MD5 31944ef831256a3296e556fd450d8b9d
SHA1 6154d8a0feeca25e937663cbde64c938d1323954
SHA512 17a3a4921bb52c510931b20e508cbc53c587d0496b6355e863cefb5748580ecd3d8cb3362e95e6eea594a5e6f21596e846e4f500a72ea20adb09568ee475c01c
SSDEEP 6144:oNhSAfuQGAG2SDgQtWszcOS2+moQOW94Ipk4:oNhBJitWYoOOIpk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\setup.exe
Size 427KB
SHA256 7d3454f70d774a1d7c30f87d0547263aae7836e45d0634e4bf26bdfa47e28d3c
MD5 276cafd770e66d445e6e54b0a7b98ffa
SHA1 90252b9ce8a87d3c82b946074f77102008924adc
SHA512 e15c4721b66c196248df70a7cb10739c27a104c8f7a7ca4163377317171e15bcf9a893cd5c37878e21c061003a5fd2145a345b4f704660870c4e4f786e7f03b9
SSDEEP 12288:oNhBJitWYoOOIpkYQJsYwA8/BLDjoFrxzebIz+WW:cBgcY8DlBODUzzEIdW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3096-7-0x0000000000400000-0x000000000066D000-memory.dmp

Download

memory/3096-13-0x0000000000400000-0x000000000066D000-memory.dmp

Download

memory/4640-0-0x0000000000400000-0x000000000066D000-memory.dmp

Download

memory/4640-1-0x0000000000400000-0x000000000066D000-memory.dmp

Download

memory/4640-6-0x0000000000400000-0x000000000066D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads