8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2

General

Target

8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
Size

1.2MB
MD5

7a2a3cc24199f86f3095d329335742bf
SHA1

115f14e5c083de1d3281fe7bb9d2f995813fd185
SHA256

8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2
SHA512

3de4a926d34953fcd9171b45670e5f4be8c933da76b630e5e0f94dbe2c3995e50859057ca48d3a3e20a08038bdcf56e4905c1fd3fd2b3f65c8cabb257c76bbee
SSDEEP

24576:USu1S82mBVrIiudq1WvX17XxUgbpVUxHZsPYE7C:USuU82mTV6l1UYpeHC

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe

description	pid	process	target process
PID 2240 set thread context of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2412 2016 WerFault.exe 8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe

pid process

2016 8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe

pid	pid_target	process	target process
2412	2016	WerFault.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe

pid	process
2016	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe

description	pid	process	target process
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2240 wrote to memory of 2016	2240	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
PID 2016 wrote to memory of 2412	2016	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	WerFault.exe
PID 2016 wrote to memory of 2412	2016	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	WerFault.exe
PID 2016 wrote to memory of 2412	2016	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	WerFault.exe
PID 2016 wrote to memory of 2412	2016	8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
"C:\Users\Admin\AppData\Local\Temp\8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\AppData\Local\Temp\8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe
"C:\Users\Admin\AppData\Local\Temp\8e68d12aa3dbfabcfc25976e7c1d441121e22b3b0c06c500f03cb6af35ee4ed2.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
3⤵
- Program crash
PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2016-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2016-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2016-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2016-13-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download
memory/2016-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2240-0-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/2240-1-0x00000000011E0000-0x000000000131C000-memory.dmp

Filesize
1.2MB

Download
memory/2240-2-0x0000000004870000-0x00000000048E6000-memory.dmp

Filesize
472KB

Download
memory/2240-3-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2240-4-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/2240-12-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing