3e903bce863a1b6c6e5c437eca730d4046aa2e59763b7c165d073e5a6a528397

Analysis

max time kernel
114s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aaaaas.exe
Size

218KB
MD5

27c53584e80d7ba7dbeb97f145984919
SHA1

248d66b605b615536a6ae89bff91705c47d4b96b
SHA256

bcf9668bad045d4cc12709ccfe602dc13e2ad4aa308d56e4d0bc70d1e3de5b4b
SHA512

d887dc1b159df86df3903b6dea3d03040f08cedc70b1b398101eb628717c4fe1e417d8037741649a8ed11f0c06bdf891f4696bf713e0de76398174c07aaf1f29
SSDEEP

6144:6jwpuNRGqi98bC03akOQOBJ+zNWe2h91Ke3dRo:zvtybC7XvENWeElo

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3332 set thread context of 1572	3332	aaaaas.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	1572	WerFault.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3332	aaaaas.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85
PID 3332 wrote to memory of 1572	3332	aaaaas.exe	85

C:\Users\Admin\AppData\Local\Temp\aaaaas.exe
"C:\Users\Admin\AppData\Local\Temp\aaaaas.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\aaaaas.exe
  "C:\Users\Admin\AppData\Local\Temp\aaaaas.exe"
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 436
    3⤵
    - Program crash
    PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1572 -ip 1572
1⤵
PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-16-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1572-23-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1572-21-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1572-19-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3332-5-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/3332-12-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/3332-6-0x0000000076F02000-0x0000000076F03000-memory.dmp

Filesize
4KB

Download
memory/3332-7-0x0000000076D30000-0x0000000076E20000-memory.dmp

Filesize
960KB

Download
memory/3332-8-0x0000000076F03000-0x0000000076F04000-memory.dmp

Filesize
4KB

Download
memory/3332-10-0x00000000023C0000-0x00000000023D0000-memory.dmp

Filesize
64KB

Download
memory/3332-9-0x0000000076EF3000-0x0000000076EF4000-memory.dmp

Filesize
4KB

Download
memory/3332-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3332-13-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3332-4-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/3332-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3332-3-0x00000000021B0000-0x00000000021E9000-memory.dmp

Filesize
228KB

Download
memory/3332-20-0x00000000021B0000-0x00000000021E9000-memory.dmp

Filesize
228KB

Download
memory/3332-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3332-22-0x0000000076D30000-0x0000000076E20000-memory.dmp

Filesize
960KB

Download
memory/3332-2-0x00000000006D0000-0x00000000006D4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads