3a782bc851f1bf6cb26787ec03a15b14f99c0c4911bb6e6723d81eac386d0f24 | Triage

Analysis

max time kernel
157s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 11:29

Sharing

Report Analysis Logs

General

Target

4e2eaed011b400990899ed03c62b71f0.exe
Size

490KB
MD5

4e2eaed011b400990899ed03c62b71f0
SHA1

b2438f79e53493a6b78a84b1f8883c1900776080
SHA256

3a782bc851f1bf6cb26787ec03a15b14f99c0c4911bb6e6723d81eac386d0f24
SHA512

2021107698fe9c590490b7c5a04a447fac273a2af43d6ec83e426b926ead5fbe58ff5fededc644b4ed2510c0bb14cba0dd2977e3a9f33f473a5dba56428a385b
SSDEEP

12288:U1FIAhwASC2AFCYG9+LbRQ+RhKr5rZnlBIC:8r2ASCt7vJQ+RhKNJlGC

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 1812	1848	4e2eaed011b400990899ed03c62b71f0.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	1812	WerFault.exe	89

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1812	1848	4e2eaed011b400990899ed03c62b71f0.exe	89
PID 1848 wrote to memory of 1812	1848	4e2eaed011b400990899ed03c62b71f0.exe	89
PID 1848 wrote to memory of 1812	1848	4e2eaed011b400990899ed03c62b71f0.exe	89
PID 1848 wrote to memory of 1812	1848	4e2eaed011b400990899ed03c62b71f0.exe	89
PID 1848 wrote to memory of 1812	1848	4e2eaed011b400990899ed03c62b71f0.exe	89

C:\Users\Admin\AppData\Local\Temp\4e2eaed011b400990899ed03c62b71f0.exe
"C:\Users\Admin\AppData\Local\Temp\4e2eaed011b400990899ed03c62b71f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\4e2eaed011b400990899ed03c62b71f0.exe
  C:\Users\Admin\AppData\Local\Temp\4e2eaed011b400990899ed03c62b71f0.exe
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 460
    3⤵
    - Program crash
    PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1812 -ip 1812
1⤵
PID:4448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1812-3-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1812-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1848-0-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/1848-4-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download