c2a1b97d657542e949496bc96e5a6c4e0beb101a629e7591519d0cb7e906dbfa | Triage

Resubmissions

08-04-2024 14:10

240408-rg3c3sba45 10

08-04-2024 14:07

240408-re6bysah74 10

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 14:10

Sharing

Report Analysis Logs

General

Target

XWorm-V5.0/FixNoStart/Fix64.exe
Size

101KB
MD5

3bd72a361ce4e5514c2e6eee83f08545
SHA1

a5089aa08760b87c7940e6e1e0eac39509a1a9da
SHA256

62a14b870bde8d57e50360039d3474210d1fdaf490afdd1bf36ce92fbaff893b
SHA512

4cc7da68e5b766be6ace9d9ae0458fd09b827fc565dc545ad9d43b4f87638e622f3d280189c23e521dbac3311c583f66d96a9ce751b9aa985036a46b0f2cbc7d
SSDEEP

1536:ddWE5W74A8VeAO6qmyVttdGFQeOPigx9:NJA8VHjqmyBeu9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2228 2156 WerFault.exe Fix64.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Fix64.exe

description	pid	process	target process
PID 2156 wrote to memory of 2228	2156	Fix64.exe	WerFault.exe
PID 2156 wrote to memory of 2228	2156	Fix64.exe	WerFault.exe
PID 2156 wrote to memory of 2228	2156	Fix64.exe	WerFault.exe
PID 2156 wrote to memory of 2228	2156	Fix64.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\XWorm-V5.0\FixNoStart\Fix64.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-V5.0\FixNoStart\Fix64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 556
2⤵
- Program crash
PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x00000000012C0000-0x00000000012DE000-memory.dmp

Filesize
120KB

Download
memory/2156-1-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/2156-2-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download