Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-02-2024 23:00

General

  • Target

    file.exe

  • Size

    317KB

  • MD5

    5352e846611bdf4ad7482d7a64445190

  • SHA1

    5d44de3ee7144a7a3566f362d277c29dee41594f

  • SHA256

    90cc438e254ee84a0362aaab2d05ca61022c2a9d855651831ea9331bdf4a54f7

  • SHA512

    120e2e381e0347fb2990d74622f2448dd88d2e27db49d18b79e17fd18604c1096f9adead0f8b5fbf35615a9829da0812dd6919a00473eee38d7227335988b3ea

  • SSDEEP

    6144:v58T0cNW9wInNW0jIyV16HTqU7ruGr3OUik7/SVYmzK:veIcNWztUqgv7hGk7/Id+

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 260
        3⤵
        • Program crash
        PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2196-7-0x0000000002070000-0x0000000004070000-memory.dmp

    Filesize

    32.0MB

  • memory/2196-1-0x00000000741F0000-0x00000000748DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2196-16-0x00000000741F0000-0x00000000748DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2196-0-0x00000000000E0000-0x0000000000130000-memory.dmp

    Filesize

    320KB

  • memory/2908-9-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2908-6-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2908-5-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2908-8-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2908-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2908-12-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2908-15-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2908-4-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2908-17-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/2908-18-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB