afd479085a58d4179763830dbfcfebcf39461ad7a7589bbba43417859d2c61c9 | Triage

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 23:51

Sharing

Report Analysis Logs

General

Target

a0aad14b7596a1900ef283c9525cf87c.exe
Size

27KB
MD5

a0aad14b7596a1900ef283c9525cf87c
SHA1

af2e46ef0e650a6a47522b64b5c3e75084a046bb
SHA256

afd479085a58d4179763830dbfcfebcf39461ad7a7589bbba43417859d2c61c9
SHA512

0ea39663755d5cc9fad90b56d958f0bb0c015797d4b13f00244c8d7f4599800d706dea75a70eff6ba12486e03202d10574cc889f4a5f1b86975380ad1224cb13
SSDEEP

768:VQjrjH4zBH2lC4CrleNlBk1OG/Tdk24t6:VQjrL2BmCjhuLKObA

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3940-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3940-7-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gbvgbv16.exe	a0aad14b7596a1900ef283c9525cf87c.exe
File opened for modification	C:\Windows\SysWOW64\gbvgbv16.exe	a0aad14b7596a1900ef283c9525cf87c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\fonts\dbr16031.ttf	a0aad14b7596a1900ef283c9525cf87c.exe
File opened for modification	C:\Windows\fonts\dbr16031.ttf	a0aad14b7596a1900ef283c9525cf87c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1512	3940	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\a0aad14b7596a1900ef283c9525cf87c.exe
"C:\Users\Admin\AppData\Local\Temp\a0aad14b7596a1900ef283c9525cf87c.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 316
  2⤵
  - Program crash
  PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3940 -ip 3940
1⤵
PID:4448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3940-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download