Analysis
-
max time kernel
72s -
max time network
189s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
05-05-2024 22:29
Static task
static1
Behavioral task
behavioral1
Sample
37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe
Resource
win7-20231129-en
gluptebaprivateloaderstealczgratdiscoverydropperevasionexecutionloaderpersistenceransomwareratrootkitspywarestealerthemidatrojanupx
56 signatures
300 seconds
Behavioral task
behavioral2
Sample
37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe
Resource
win10-20240404-en
3 signatures
300 seconds
General
-
Target
37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe
-
Size
3.4MB
-
MD5
886e5d7f4e35c0bb6164dc74bf5e371b
-
SHA1
009dd91c1ecfa4c39374437f7415871144aaa88b
-
SHA256
37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4
-
SHA512
b0518c38397749e249e716634541fb9901961ae78734711ef7d7a6446aba4e3d60d073f03532e6aa32f2320a5c30e817647b7aa077b5978b0f0d407375e89994
-
SSDEEP
49152:eg6HD4YPpoVBQQAbNwmW6Vvfw5ADqfzgF4Cdypovv:0VBFsGvkAF3
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4568 set thread context of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73 -
Program crash 1 IoCs
pid pid_target Process procid_target 3748 4664 WerFault.exe 73 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4568 wrote to memory of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73 PID 4568 wrote to memory of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73 PID 4568 wrote to memory of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73 PID 4568 wrote to memory of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73 PID 4568 wrote to memory of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73 PID 4568 wrote to memory of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73 PID 4568 wrote to memory of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73 PID 4568 wrote to memory of 4664 4568 37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe"C:\Users\Admin\AppData\Local\Temp\37a08c70daddf5079288e71df5796d5cd1a2e67fd3b71a4b3492514abca524c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:4664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 1643⤵
- Program crash
PID:3748
-
-