58ace8404d8fbfca96c562f3415948073f713c799eb466627dbd9988cabd1c56

Resubmissions

01-02-2024 00:53

240201-a8yqjafgc7 5

31-01-2024 23:58

240131-3z5rpsghgn 5

Analysis

max time kernel
132s
max time network
151s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
01-02-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

631KB
MD5

1850ff637de86020fe977b676b5c81ca
SHA1

3e4774068a1412a979644427ed505c9a1ae72f8e
SHA256

58ace8404d8fbfca96c562f3415948073f713c799eb466627dbd9988cabd1c56
SHA512

73597991c552f44cab018b57278a416a32ee42b886bfa9b6697bb6a6040093b2ec9980b20c58b28f57939e5a80fa7850862ea7f8f8c1d556d8d3fb814c5c4d0b
SSDEEP

12288:xSVqEbPdYx17gyJZEFy3a55a+xwdcq8N8NRyaPxJTTIrCoiycyN:xS4Eb1Yx17JmyK7jUcqrXLPxJ0Ckc4

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3500 set thread context of 3688	3500	file.exe	74

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4152	3688	WerFault.exe	74
4536	3688	WerFault.exe	74

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 3688	3500	file.exe	74
PID 3500 wrote to memory of 3688	3500	file.exe	74
PID 3500 wrote to memory of 3688	3500	file.exe	74
PID 3500 wrote to memory of 3688	3500	file.exe	74
PID 3500 wrote to memory of 3688	3500	file.exe	74
PID 3500 wrote to memory of 3688	3500	file.exe	74
PID 3500 wrote to memory of 3688	3500	file.exe	74
PID 3500 wrote to memory of 3688	3500	file.exe	74
PID 3500 wrote to memory of 3688	3500	file.exe	74

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1176
    3⤵
    - Program crash
    PID:4152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1216
    3⤵
    - Program crash
    PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3500-10-0x0000000003280000-0x0000000005280000-memory.dmp

Filesize
32.0MB

Download
memory/3500-1-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/3500-2-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/3500-17-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/3500-0-0x0000000000F00000-0x0000000000FA2000-memory.dmp

Filesize
648KB

Download
memory/3688-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3688-5-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3688-12-0x0000000001020000-0x0000000001060000-memory.dmp

Filesize
256KB

Download
memory/3688-13-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3688-14-0x0000000001060000-0x00000000010A0000-memory.dmp

Filesize
256KB

Download
memory/3688-15-0x0000000001060000-0x00000000010A0000-memory.dmp

Filesize
256KB

Download
memory/3688-16-0x0000000001060000-0x00000000010A0000-memory.dmp

Filesize
256KB

Download
memory/3688-11-0x0000000001020000-0x0000000001060000-memory.dmp

Filesize
256KB

Download
memory/3688-18-0x0000000001020000-0x0000000001060000-memory.dmp

Filesize
256KB

Download
memory/3688-19-0x0000000001020000-0x0000000001060000-memory.dmp

Filesize
256KB

Download
memory/3688-20-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3688-21-0x0000000001060000-0x00000000010A0000-memory.dmp

Filesize
256KB

Download
memory/3688-22-0x0000000001060000-0x00000000010A0000-memory.dmp

Filesize
256KB

Download
memory/3688-23-0x0000000001060000-0x00000000010A0000-memory.dmp

Filesize
256KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads