Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
15-01-2024 13:32
General
-
Target
5d36a8d835a2207213efed20ee9294da.exe
-
Size
2.8MB
-
MD5
5d36a8d835a2207213efed20ee9294da
-
SHA1
8a02634c5040755f24cb7bbaf8f4b1577b49761c
-
SHA256
44648da1ebbf8ed242e9f93b9b8cbe9e035246f245b6b3b22534931725c42499
-
SHA512
858c52d462fda710b2652dcef4ef5dd9756a6c1bb0633a7f306690c3070f2adce3ccab7623d6f1334420c7f39421c420c7d4c0178bb1893a0d8d0c4f3afcea15
-
SSDEEP
24576:zQWYepR87h9dgxDq7FzGeeVhTilIqSCdzKPQkaxgA1Zk4OYIExiPInVxw+zyWnM1:5YN7jdg8keeVFmEQ5g5rEgAnV+rWp8
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d36a8d835a2207213efed20ee9294da.exe"C:\Users\Admin\AppData\Local\Temp\5d36a8d835a2207213efed20ee9294da.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5d36a8d835a2207213efed20ee9294da.exe"C:\Users\Admin\AppData\Local\Temp\5d36a8d835a2207213efed20ee9294da.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 1843⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1348 -ip 13481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
2.8MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
7.7MB