Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
11-01-2024 04:04
General
-
Target
527c0a92f14411fd7cbb755d680eac7a.exe
-
Size
754KB
-
MD5
527c0a92f14411fd7cbb755d680eac7a
-
SHA1
8df3dbe928757deee5a78b1859cc8c802ed01685
-
SHA256
16a6b731a1ed644dfcf898bf8a42246266c12c4f29b75ef0af60e9e2a22f86a0
-
SHA512
31d56df65f7c543f222728d2e3671d5d98cf063405c3f74b73ede70b0f80c53ed06d11e4134161283a5e6466c0b0c9d09f0c640e742e6c62bda11fc111afd35a
-
SSDEEP
12288:7BhyRKF9Je6ouxOtgwl0VgcLD7cFM1MY1S1jeqcpfpu9ljNq3jbGNDmUAMNKoNNl:/oKF9JlCWTHDcFhY1SuUlNWjbqmUjNbB
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 3 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\527c0a92f14411fd7cbb755d680eac7a.exe"C:\Users\Admin\AppData\Local\Temp\527c0a92f14411fd7cbb755d680eac7a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe relaunch2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 15243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 7843⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 15403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1520 -ip 15201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1520 -ip 15201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1520 -ip 15201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB