c2a1b97d657542e949496bc96e5a6c4e0beb101a629e7591519d0cb7e906dbfa | Triage

Resubmissions

08-04-2024 14:10

240408-rg3c3sba45 10

08-04-2024 14:07

240408-re6bysah74 10

Analysis

max time kernel
92s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 14:10

Sharing

Report Analysis Logs

General

Target

XWorm-V5.0/FixNoStart/Fix64.exe
Size

101KB
MD5

3bd72a361ce4e5514c2e6eee83f08545
SHA1

a5089aa08760b87c7940e6e1e0eac39509a1a9da
SHA256

62a14b870bde8d57e50360039d3474210d1fdaf490afdd1bf36ce92fbaff893b
SHA512

4cc7da68e5b766be6ace9d9ae0458fd09b827fc565dc545ad9d43b4f87638e622f3d280189c23e521dbac3311c583f66d96a9ce751b9aa985036a46b0f2cbc7d
SSDEEP

1536:ddWE5W74A8VeAO6qmyVttdGFQeOPigx9:NJA8VHjqmyBeu9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 4448 WerFault.exe Fix64.exe

C:\Users\Admin\AppData\Local\Temp\XWorm-V5.0\FixNoStart\Fix64.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-V5.0\FixNoStart\Fix64.exe"
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 832
2⤵
- Program crash
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4448 -ip 4448
1⤵
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4448-1-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4448-0-0x0000000000EE0000-0x0000000000EFE000-memory.dmp

Filesize
120KB

Download
memory/4448-2-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download