23b246c5f034a82ae3b57eb027cdfd7f91850d048b0ff47639f8fe21cd1572ec

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75209a29134e95890be16db575c65e3a.exe
Size

1.5MB
MD5

75209a29134e95890be16db575c65e3a
SHA1

2ad0d397fd9bb87438821c046397858762a2fb65
SHA256

23b246c5f034a82ae3b57eb027cdfd7f91850d048b0ff47639f8fe21cd1572ec
SHA512

b599907b59b1d234ae946d18525021838f7078c0d1dcab62de452114041bcd656d5b0fa6d5ac98ac079b8219a5e62449f1b55639ddf8c0cd3c16c1c326284414
SSDEEP

24576:7eHMRD+hEvpx/0lR7pLZuDyV/Hm8j4ICFiOzk7h36TavSqayOs1Rn46Vx:7eH2DaypxUR7zmyVeBeOo7h3VqyOS46j

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

75209a29134e95890be16db575c65e3a.exe

pid process

2236 75209a29134e95890be16db575c65e3a.exe
2236 75209a29134e95890be16db575c65e3a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2400 2236 WerFault.exe 75209a29134e95890be16db575c65e3a.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

75209a29134e95890be16db575c65e3a.exe

pid process

2236 75209a29134e95890be16db575c65e3a.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

75209a29134e95890be16db575c65e3a.exe

pid process

2236 75209a29134e95890be16db575c65e3a.exe
2236 75209a29134e95890be16db575c65e3a.exe

pid	process
2236	75209a29134e95890be16db575c65e3a.exe
2236	75209a29134e95890be16db575c65e3a.exe

pid	pid_target	process	target process
2400	2236	WerFault.exe	75209a29134e95890be16db575c65e3a.exe

pid	process
2236	75209a29134e95890be16db575c65e3a.exe

pid	process
2236	75209a29134e95890be16db575c65e3a.exe
2236	75209a29134e95890be16db575c65e3a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

75209a29134e95890be16db575c65e3a.exe

description	pid	process	target process
PID 2236 wrote to memory of 2400	2236	75209a29134e95890be16db575c65e3a.exe	WerFault.exe
PID 2236 wrote to memory of 2400	2236	75209a29134e95890be16db575c65e3a.exe	WerFault.exe
PID 2236 wrote to memory of 2400	2236	75209a29134e95890be16db575c65e3a.exe	WerFault.exe
PID 2236 wrote to memory of 2400	2236	75209a29134e95890be16db575c65e3a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\75209a29134e95890be16db575c65e3a.exe
"C:\Users\Admin\AppData\Local\Temp\75209a29134e95890be16db575c65e3a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 344
2⤵
- Program crash
PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000000400000-0x00000000007E2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-1-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-3-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-4-0x0000000076FDF000-0x0000000076FE0000-memory.dmp

Filesize
4KB

Download
memory/2236-6-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-8-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-10-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-13-0x0000000076FDF000-0x0000000076FE0000-memory.dmp

Filesize
4KB

Download
memory/2236-12-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-15-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-17-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-19-0x0000000000400000-0x00000000007E2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-20-0x0000000076FDF000-0x0000000076FE0000-memory.dmp

Filesize
4KB

Download
memory/2236-21-0x0000000076FE0000-0x0000000076FE1000-memory.dmp

Filesize
4KB

Download
memory/2236-23-0x0000000077150000-0x0000000077151000-memory.dmp

Filesize
4KB

Download
memory/2236-24-0x0000000000230000-0x0000000000274000-memory.dmp

Filesize
272KB

Download
memory/2236-29-0x0000000000230000-0x0000000000274000-memory.dmp

Filesize
272KB

Download
memory/2236-30-0x0000000000400000-0x00000000007E2000-memory.dmp

Filesize
3.9MB

Download