53c50ffec796c58a62159c70826e1903764ed8c43796900f834fd55f94e13660 | Triage

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 08:09

Sharing

Report Analysis Logs

General

Target

RFQ-HL51L05.exe
Size

1.1MB
MD5

254d0303fffb227dde317b5e2bb664ae
SHA1

f538ce2f5b72eaf0ecfb4a0b4a8af43436c0fb46
SHA256

78fad406a45c2723861ac043560f4fcbe8ff4df4c5e49e702833944af1220e53
SHA512

a9ef2d93e73edeac629d4c927c4e439e9e5b5a67e718edc8e638f7a99bb25745335bf633091dfda02ff6df4b21100106d0f48f4e1882e24ed19294c984213203
SSDEEP

24576:NAHnh+eWsN3skA4RV1Hom2KXMmHa+Lm1ESsb5:sh+ZkldoPK8Ya+6af

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3292 3456 WerFault.exe RFQ-HL51L05.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

RFQ-HL51L05.exe

pid process

3456 RFQ-HL51L05.exe
3456 RFQ-HL51L05.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

RFQ-HL51L05.exe

pid process

3456 RFQ-HL51L05.exe
3456 RFQ-HL51L05.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

RFQ-HL51L05.exe

description	pid	process	target process
PID 3456 wrote to memory of 3124	3456	RFQ-HL51L05.exe	RegSvcs.exe
PID 3456 wrote to memory of 3124	3456	RFQ-HL51L05.exe	RegSvcs.exe
PID 3456 wrote to memory of 3124	3456	RFQ-HL51L05.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\RFQ-HL51L05.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-HL51L05.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-HL51L05.exe"
2⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 700
2⤵
- Program crash
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3456 -ip 3456
1⤵
PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3456-10-0x00000000009B0000-0x00000000009B4000-memory.dmp

Filesize
16KB

Download