6638dbbf07cbef08a28dbd1abb294392c573d59b1739f292bd62497cd754a223

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99c1bbf153860a70c191a2a0832beb98.exe
Size

1.3MB
MD5

99c1bbf153860a70c191a2a0832beb98
SHA1

91a11146d108ee3af90f360a1a759e89d7adc152
SHA256

6638dbbf07cbef08a28dbd1abb294392c573d59b1739f292bd62497cd754a223
SHA512

04d78d21ce93ccec90ed914ce34048eb35c94f2a75177ba5074bfb3a9477c4a55ae416da1f86efbc6e2684cd562e9c3ac0608e97a6dde469a92747aeb3dd3cca
SSDEEP

24576:GvwQyBaWnBCqyaaNCM2OAjgyojOvo4RlnbtNwIwIbocwR81s5x5DsAFt:GvlyBaWntyrNBlARojCzTbL4c7s3x7Ft

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2496	99c1bbf153860a70c191a2a0832beb98.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2496 set thread context of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	2192	WerFault.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2496	99c1bbf153860a70c191a2a0832beb98.exe
2496	99c1bbf153860a70c191a2a0832beb98.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2496 wrote to memory of 2192	2496	99c1bbf153860a70c191a2a0832beb98.exe	28
PID 2192 wrote to memory of 2124	2192	99c1bbf153860a70c191a2a0832beb98.exe	29
PID 2192 wrote to memory of 2124	2192	99c1bbf153860a70c191a2a0832beb98.exe	29
PID 2192 wrote to memory of 2124	2192	99c1bbf153860a70c191a2a0832beb98.exe	29
PID 2192 wrote to memory of 2124	2192	99c1bbf153860a70c191a2a0832beb98.exe	29

C:\Users\Admin\AppData\Local\Temp\99c1bbf153860a70c191a2a0832beb98.exe
"C:\Users\Admin\AppData\Local\Temp\99c1bbf153860a70c191a2a0832beb98.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\99c1bbf153860a70c191a2a0832beb98.exe
  C:\Users\Admin\AppData\Local\Temp\99c1bbf153860a70c191a2a0832beb98.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 176
    3⤵
    - Program crash
    PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-4-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download
memory/2192-8-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download
memory/2496-0-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download
memory/2496-6-0x0000000003EA0000-0x0000000004249000-memory.dmp

Filesize
3.7MB

Download
memory/2496-9-0x0000000000400000-0x00000000007A9000-memory.dmp

Filesize
3.7MB

Download