Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2024 13:32
Static task
static1
Behavioral task
behavioral1
Sample
5d36a8d835a2207213efed20ee9294da.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5d36a8d835a2207213efed20ee9294da.exe
Resource
win10v2004-20231215-en
General
-
Target
5d36a8d835a2207213efed20ee9294da.exe
-
Size
2.8MB
-
MD5
5d36a8d835a2207213efed20ee9294da
-
SHA1
8a02634c5040755f24cb7bbaf8f4b1577b49761c
-
SHA256
44648da1ebbf8ed242e9f93b9b8cbe9e035246f245b6b3b22534931725c42499
-
SHA512
858c52d462fda710b2652dcef4ef5dd9756a6c1bb0633a7f306690c3070f2adce3ccab7623d6f1334420c7f39421c420c7d4c0178bb1893a0d8d0c4f3afcea15
-
SSDEEP
24576:zQWYepR87h9dgxDq7FzGeeVhTilIqSCdzKPQkaxgA1Zk4OYIExiPInVxw+zyWnM1:5YN7jdg8keeVFmEQ5g5rEgAnV+rWp8
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1348-8-0x0000000000E10000-0x00000000011EE000-memory.dmp upx behavioral2/memory/1348-9-0x0000000000E10000-0x00000000011EE000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d36a8d835a2207213efed20ee9294da.exedescription pid process target process PID 3056 set thread context of 1348 3056 5d36a8d835a2207213efed20ee9294da.exe 5d36a8d835a2207213efed20ee9294da.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4140 1348 WerFault.exe 5d36a8d835a2207213efed20ee9294da.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
5d36a8d835a2207213efed20ee9294da.exedescription pid process target process PID 3056 wrote to memory of 1348 3056 5d36a8d835a2207213efed20ee9294da.exe 5d36a8d835a2207213efed20ee9294da.exe PID 3056 wrote to memory of 1348 3056 5d36a8d835a2207213efed20ee9294da.exe 5d36a8d835a2207213efed20ee9294da.exe PID 3056 wrote to memory of 1348 3056 5d36a8d835a2207213efed20ee9294da.exe 5d36a8d835a2207213efed20ee9294da.exe PID 3056 wrote to memory of 1348 3056 5d36a8d835a2207213efed20ee9294da.exe 5d36a8d835a2207213efed20ee9294da.exe PID 3056 wrote to memory of 1348 3056 5d36a8d835a2207213efed20ee9294da.exe 5d36a8d835a2207213efed20ee9294da.exe PID 3056 wrote to memory of 1348 3056 5d36a8d835a2207213efed20ee9294da.exe 5d36a8d835a2207213efed20ee9294da.exe PID 3056 wrote to memory of 1348 3056 5d36a8d835a2207213efed20ee9294da.exe 5d36a8d835a2207213efed20ee9294da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d36a8d835a2207213efed20ee9294da.exe"C:\Users\Admin\AppData\Local\Temp\5d36a8d835a2207213efed20ee9294da.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5d36a8d835a2207213efed20ee9294da.exe"C:\Users\Admin\AppData\Local\Temp\5d36a8d835a2207213efed20ee9294da.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 1843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1348 -ip 13481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1348-8-0x0000000000E10000-0x00000000011EE000-memory.dmpFilesize
3.9MB
-
memory/1348-9-0x0000000000E10000-0x00000000011EE000-memory.dmpFilesize
3.9MB
-
memory/3056-1-0x0000000000FC0000-0x0000000001294000-memory.dmpFilesize
2.8MB
-
memory/3056-0-0x0000000074B40000-0x00000000752F0000-memory.dmpFilesize
7.7MB
-
memory/3056-2-0x00000000061A0000-0x0000000006744000-memory.dmpFilesize
5.6MB
-
memory/3056-3-0x0000000005C90000-0x0000000005D22000-memory.dmpFilesize
584KB
-
memory/3056-4-0x0000000074B40000-0x00000000752F0000-memory.dmpFilesize
7.7MB
-
memory/3056-5-0x0000000005C80000-0x0000000005C90000-memory.dmpFilesize
64KB
-
memory/3056-6-0x00000000060B0000-0x00000000060B8000-memory.dmpFilesize
32KB
-
memory/3056-10-0x0000000074B40000-0x00000000752F0000-memory.dmpFilesize
7.7MB