Analysis
-
max time kernel
125s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
17-01-2024 15:00
Behavioral task
behavioral1
Sample
2216-135-0x0000000000400000-0x000000000040A000-memory.exe
Resource
win7-20231215-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2216-135-0x0000000000400000-0x000000000040A000-memory.exe
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
2216-135-0x0000000000400000-0x000000000040A000-memory.exe
-
Size
40KB
-
MD5
b1b4123629870aab48fdb895addd598c
-
SHA1
f0db3342f83408fbfa9020ddca72822663f7583b
-
SHA256
45fbc31e3facac03ca4f60ed11f18388577f23754f7b95361fec74fafc0e4512
-
SHA512
6892838d46fead51969c4dd0ab5e934f3db136831480767ea79ccb1a275a513c0ac7d55d0f94d04ecb326e3fa23bf357c2aae68f0093b8ecda9a6761b6baabb8
-
SSDEEP
192:1+8C+EKS0O9ejYTDG8bcp4LlHanieXubWyD9JEBkGxVXGfqoN+RJw:1NVjYTDG8gpOBeXTyD3EnxESoNJ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4480 4556 WerFault.exe 2216-135-0x0000000000400000-0x000000000040A000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2216-135-0x0000000000400000-0x000000000040A000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2216-135-0x0000000000400000-0x000000000040A000-memory.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 2002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4556 -ip 45561⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3256-16-0x000001D6DF740000-0x000001D6DF750000-memory.dmpFilesize
64KB
-
memory/3256-0-0x000001D6DF640000-0x000001D6DF650000-memory.dmpFilesize
64KB
-
memory/3256-32-0x000001D6E7A90000-0x000001D6E7A91000-memory.dmpFilesize
4KB
-
memory/3256-36-0x000001D6E7BD0000-0x000001D6E7BD1000-memory.dmpFilesize
4KB
-
memory/3256-35-0x000001D6E7AC0000-0x000001D6E7AC1000-memory.dmpFilesize
4KB
-
memory/3256-34-0x000001D6E7AC0000-0x000001D6E7AC1000-memory.dmpFilesize
4KB