e95d5046970872f51ad1d86cef75cf697d06f3a6b16515aa2eef09f9145e5ef6

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DRAFT DOCS RSHA25491003.exe
Size 639KB
Sample240326-nby7pagg99
SHA256 e95d5046970872f51ad1d86cef75cf697d06f3a6b16515aa2eef09f9145e5ef6
MD5 018a61de9db2f306e6235fba720df9ac
SHA1 a41e0389beb2ef984fa11a573fd213d935f82167
SHA512 7a7549e55e296db79ffdbf8272d8c6e9ed6d55cdd9527185cc26675ab432452ed80f3cc2af2679b45c16f63e3cfba681be71df456a2816651f89f1ef8342b057
SSDEEP 12288:qFpE7taI01xI7RD+EM23a1UtSDHt7TwlMG+iaYIyrmAua5W:+H10RRVNuHtXVG+ijZrvK
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 3352	2568	DRAFT DOCS RSHA25491003.exe	100

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4712	3352	WerFault.exe	100

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe
3352	DRAFT DOCS RSHA25491003.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3352	DRAFT DOCS RSHA25491003.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 3352	2568	DRAFT DOCS RSHA25491003.exe	100
PID 2568 wrote to memory of 3352	2568	DRAFT DOCS RSHA25491003.exe	100
PID 2568 wrote to memory of 3352	2568	DRAFT DOCS RSHA25491003.exe	100
PID 2568 wrote to memory of 3352	2568	DRAFT DOCS RSHA25491003.exe	100
PID 2568 wrote to memory of 3352	2568	DRAFT DOCS RSHA25491003.exe	100
PID 2568 wrote to memory of 3352	2568	DRAFT DOCS RSHA25491003.exe	100

C:\Users\Admin\AppData\Local\Temp\DRAFT DOCS RSHA25491003.exe
"C:\Users\Admin\AppData\Local\Temp\DRAFT DOCS RSHA25491003.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\DRAFT DOCS RSHA25491003.exe
  "C:\Users\Admin\AppData\Local\Temp\DRAFT DOCS RSHA25491003.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 212
    3⤵
    - Program crash
    PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3352 -ip 3352
1⤵
PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-8-0x0000000006550000-0x00000000065DA000-memory.dmp

Download

memory/2568-9-0x0000000008BA0000-0x0000000008C3C000-memory.dmp

Download

memory/2568-2-0x0000000005530000-0x0000000005AD4000-memory.dmp

Download

memory/2568-3-0x0000000004E90000-0x0000000004F22000-memory.dmp

Download

memory/2568-4-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/2568-5-0x0000000004F60000-0x0000000004F6A000-memory.dmp

Download

memory/2568-1-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/2568-6-0x00000000051B0000-0x00000000051C2000-memory.dmp

Download

memory/2568-0-0x0000000000450000-0x00000000004F6000-memory.dmp

Download

memory/2568-7-0x00000000054E0000-0x00000000054EC000-memory.dmp

Download

memory/2568-12-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/3352-10-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3352-13-0x0000000001090000-0x00000000013DA000-memory.dmp

Download

memory/3352-14-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3352-15-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3352-16-0x0000000000400000-0x0000000000443000-memory.dmp

Download