Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 02:00
Static task
static1
Behavioral task
behavioral1
Sample
d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe
Resource
win10v2004-20240419-en
General
-
Target
d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe
-
Size
1.1MB
-
MD5
67e9c69943cca3c70450366e16f19d5c
-
SHA1
5ed01d66f03554f7df9022d53b99a5a26a835d69
-
SHA256
d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb
-
SHA512
9d7701c7767385c24e2a8d33dce07be249b7d68fdd6f8cb9e3491c3e6f93aa51022d7d62487f7bd704f03c2813f2a28dc9f1cbdf5c805494babf9ec9208fe5ce
-
SSDEEP
24576:FAHnh+eWsN3skA4RV1Hom2KXMmHamTHSffZ/CYrV5:0h+ZkldoPK8YamzSffZL
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4120 1064 WerFault.exe d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exepid process 1064 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exepid process 1064 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe 1064 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exepid process 1064 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe 1064 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exedescription pid process target process PID 1064 wrote to memory of 216 1064 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe RegSvcs.exe PID 1064 wrote to memory of 216 1064 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe RegSvcs.exe PID 1064 wrote to memory of 216 1064 d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe"C:\Users\Admin\AppData\Local\Temp\d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 7082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1064 -ip 10641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aut664B.tmpFilesize
263KB
MD53e9da8d523799a78bfd37c133c865a9f
SHA1ddc287b8623dc1df7e776fc2d733b3a81ea382ca
SHA25686dd950cb73fc9d87df98d59ba2501d132fa0b48dc4c594b2e4ce29193113d69
SHA5121c1f89ebe82696e858e24314e0f23ab7283fb2db841f79f3a91ced125f7aaae51321f3b3454ed1b36bf6d5bddf64663fe61e9a6ba8c10b6643d8c6344c8487b7
-
memory/1064-12-0x0000000002440000-0x0000000002444000-memory.dmpFilesize
16KB