0ec4dc59bfa704ff0777038d4c747fb42db308bed43f2ad6a681b645d1bfecbd

Analysis

max time kernel
1183s
max time network
1201s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
26-01-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

W7W5WFGX1D82S3EIURREUP57O.exe
Size

4.1MB
MD5

5432cd10140f359f17394c8e2340299c
SHA1

16ad79a097ff19b5089aff81b6bfa1a664affb18
SHA256

4e3934e65b6c2ea6be580d375f4515edf20643d88b5f83db63d2c0ad70ba0398
SHA512

05925ee28feb718c1d05216be2f4553b0db27f49aab42ae64559daa22c16b24b7c40de4ae83bd38e81f65173bf9584fbcbe3ad481366688a244e2e7774151f96
SSDEEP

98304:7ScbaLQaS+m0bcbE+1AZ1bpVDHBz/waoVNVncpH/s6i47:mn50N1AZ1dVLZwaoHxcpfm4

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
3532	448	WerFault.exe	71
4376	448	WerFault.exe	71

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

W7W5WFGX1D82S3EIURREUP57O.exe

description	pid	Process	procid_target
PID 448 wrote to memory of 3528	448	W7W5WFGX1D82S3EIURREUP57O.exe	72
PID 448 wrote to memory of 3528	448	W7W5WFGX1D82S3EIURREUP57O.exe	72
PID 448 wrote to memory of 3528	448	W7W5WFGX1D82S3EIURREUP57O.exe	72
PID 448 wrote to memory of 3528	448	W7W5WFGX1D82S3EIURREUP57O.exe	72
PID 448 wrote to memory of 3528	448	W7W5WFGX1D82S3EIURREUP57O.exe	72
PID 448 wrote to memory of 3528	448	W7W5WFGX1D82S3EIURREUP57O.exe	72
PID 448 wrote to memory of 3528	448	W7W5WFGX1D82S3EIURREUP57O.exe	72

C:\Users\Admin\AppData\Local\Temp\W7W5WFGX1D82S3EIURREUP57O.exe
"C:\Users\Admin\AppData\Local\Temp\W7W5WFGX1D82S3EIURREUP57O.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:3528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1016
  2⤵
  - Program crash
  PID:3532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1040
  2⤵
  - Program crash
  PID:4376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/448-0-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Filesize
6.9MB

Download
memory/448-1-0x0000000000400000-0x000000000082A000-memory.dmp

Filesize
4.2MB

Download
memory/448-2-0x00000000050B0000-0x000000000514C000-memory.dmp

Filesize
624KB

Download
memory/448-3-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Filesize
6.9MB

Download
memory/448-4-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-5-0x0000000005370000-0x0000000005524000-memory.dmp

Filesize
1.7MB

Download
memory/448-6-0x0000000006750000-0x00000000068E2000-memory.dmp

Filesize
1.6MB

Download
memory/448-7-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-8-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-9-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-10-0x0000000006930000-0x0000000006940000-memory.dmp

Filesize
64KB

Download
memory/448-11-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-12-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-13-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-14-0x0000000006B00000-0x0000000006C00000-memory.dmp

Filesize
1024KB

Download
memory/448-15-0x0000000006B00000-0x0000000006C00000-memory.dmp

Filesize
1024KB

Download
memory/448-16-0x0000000006B00000-0x0000000006C00000-memory.dmp

Filesize
1024KB

Download
memory/448-17-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-18-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-19-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-20-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-21-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/448-22-0x0000000006B00000-0x0000000006C00000-memory.dmp

Filesize
1024KB

Download
memory/448-23-0x0000000006B00000-0x0000000006C00000-memory.dmp

Filesize
1024KB

Download
memory/448-24-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Filesize
6.9MB

Download