380b8233ff261f67156ed127d938aff04cb279ead6cfe6a76702d9ea3701660f | Triage

Resubmissions

22-05-2024 19:57

240522-ypkassee44 3

Analysis

max time kernel
132s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:57

Sharing

Report Analysis Logs

General

Target

Zebra Obfuscator.exe
Size

174KB
MD5

54bf50927e0af8a664c53e98bb494697
SHA1

4470613e048ce1ee412166ff2536d0964563e9a6
SHA256

380b8233ff261f67156ed127d938aff04cb279ead6cfe6a76702d9ea3701660f
SHA512

bca2432879b2b1c892142ac4bb1297e995b86ba03776c72122805cc953f4de0bd22ea9f0c1ff36fdc5609de889f4c9d928a6aa9a1c6cbf9d91ac2fc004a11de5
SSDEEP

3072:VDlOIOA4QfuzHoNlbn2/z29tJqDumuek29tJqDumueI:VRnOAzfuM2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1132 3144 WerFault.exe Zebra Obfuscator.exe

C:\Users\Admin\AppData\Local\Temp\Zebra Obfuscator.exe
"C:\Users\Admin\AppData\Local\Temp\Zebra Obfuscator.exe"
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 828
2⤵
- Program crash
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3144 -ip 3144
1⤵
PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

Filesize
4KB

Download
memory/3144-1-0x0000000000910000-0x0000000000946000-memory.dmp

Filesize
216KB

Download
memory/3144-2-0x0000000005840000-0x0000000005DE4000-memory.dmp

Filesize
5.6MB

Download