2285f0c1350a7eaa1433d5a73f8ab8633c369d965304a9e6e79bdad6fe72503b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9b7e37838e103faab6fe218212daca6.exe
Size

1.5MB
MD5

a9b7e37838e103faab6fe218212daca6
SHA1

e6abcc92d7b50a312fc33495d2091cfbd3b1d549
SHA256

2285f0c1350a7eaa1433d5a73f8ab8633c369d965304a9e6e79bdad6fe72503b
SHA512

1619856bcb572900cd7c5b245a697528469eeaa4b678c0f6ab2486f0d252302eb7f3576e69249c0959ac6caea766900f9b4e2ce78755fc02d8f0e2e480b57779
SSDEEP

24576:yGVY/MsqdL1g79XAjy6RNr9ykLq+zEV6Rl2uFR+/pNvB3TPsLqHAdh4L2cgjekKq:yDM31g79XAW6RNYbyo/pFpBeh4Cv6pq

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2072	a9b7e37838e103faab6fe218212daca6.exe
2072	a9b7e37838e103faab6fe218212daca6.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	2072	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2072	a9b7e37838e103faab6fe218212daca6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2072	a9b7e37838e103faab6fe218212daca6.exe
2072	a9b7e37838e103faab6fe218212daca6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2608	2072	a9b7e37838e103faab6fe218212daca6.exe	28
PID 2072 wrote to memory of 2608	2072	a9b7e37838e103faab6fe218212daca6.exe	28
PID 2072 wrote to memory of 2608	2072	a9b7e37838e103faab6fe218212daca6.exe	28
PID 2072 wrote to memory of 2608	2072	a9b7e37838e103faab6fe218212daca6.exe	28

C:\Users\Admin\AppData\Local\Temp\a9b7e37838e103faab6fe218212daca6.exe
"C:\Users\Admin\AppData\Local\Temp\a9b7e37838e103faab6fe218212daca6.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 344
  2⤵
  - Program crash
  PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-0-0x0000000000400000-0x00000000007E9000-memory.dmp

Filesize
3.9MB

Download
memory/2072-1-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-3-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-5-0x00000000776FF000-0x0000000077700000-memory.dmp

Filesize
4KB

Download
memory/2072-6-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-8-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-10-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-12-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-15-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-14-0x00000000776FF000-0x0000000077700000-memory.dmp

Filesize
4KB

Download
memory/2072-17-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-21-0x00000000776FF000-0x0000000077700000-memory.dmp

Filesize
4KB

Download
memory/2072-19-0x0000000000400000-0x00000000007E9000-memory.dmp

Filesize
3.9MB

Download
memory/2072-22-0x0000000077700000-0x0000000077701000-memory.dmp

Filesize
4KB

Download
memory/2072-23-0x0000000077870000-0x0000000077871000-memory.dmp

Filesize
4KB

Download
memory/2072-24-0x00000000002F0000-0x0000000000334000-memory.dmp

Filesize
272KB

Download
memory/2072-29-0x00000000002F0000-0x0000000000334000-memory.dmp

Filesize
272KB

Download
memory/2072-30-0x0000000000400000-0x00000000007E9000-memory.dmp

Filesize
3.9MB

Download