b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe
Size

682KB
MD5

ff3dbf88b99f9e06e0cb8be49a1aae62
SHA1

aacf3513329bcdb2b31661e2f90a11a7d8dcff49
SHA256

b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f
SHA512

9201bcd6f841caad23dfd34c0135b68eba25472ba213e65ca42b5f3748fc072c6a8a3f2c081277fa533affe38281724ab0f22a60fabb80c90afec857a51676e3
SSDEEP

12288:tD3yvK/pKVbiNRSZJp1IpmyzEDJtzXbXjR7mp+gFxfq2I6uv7J79Womp7:JyvbiNERDJtzD9VgFhuXxK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 844 set thread context of 3792	844	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe	96

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	3792	WerFault.exe	96

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3792	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe
3792	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe
3792	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3792	844	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe	96
PID 844 wrote to memory of 3792	844	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe	96
PID 844 wrote to memory of 3792	844	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe	96
PID 844 wrote to memory of 3792	844	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe	96
PID 844 wrote to memory of 3792	844	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe	96
PID 844 wrote to memory of 3792	844	b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe	96

C:\Users\Admin\AppData\Local\Temp\b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe
"C:\Users\Admin\AppData\Local\Temp\b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe
  "C:\Users\Admin\AppData\Local\Temp\b785f1d99e5fdebea270af63f0e02600995989af85eb754fbb1e9cc141d26d5f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 184
    3⤵
    - Program crash
    PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3960 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3792 -ip 3792
1⤵
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-8-0x0000000007150000-0x0000000007160000-memory.dmp

Filesize
64KB

Download
memory/844-9-0x00000000071B0000-0x000000000723A000-memory.dmp

Filesize
552KB

Download
memory/844-2-0x00000000059B0000-0x0000000005F54000-memory.dmp

Filesize
5.6MB

Download
memory/844-3-0x0000000005350000-0x00000000053E2000-memory.dmp

Filesize
584KB

Download
memory/844-4-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/844-5-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/844-6-0x0000000007120000-0x0000000007136000-memory.dmp

Filesize
88KB

Download
memory/844-7-0x0000000007140000-0x000000000714C000-memory.dmp

Filesize
48KB

Download
memory/844-1-0x00000000008D0000-0x0000000000980000-memory.dmp

Filesize
704KB

Download
memory/844-10-0x00000000098F0000-0x000000000998C000-memory.dmp

Filesize
624KB

Download
memory/844-0-0x00000000752DE000-0x00000000752DF000-memory.dmp

Filesize
4KB

Download
memory/844-14-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/3792-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3792-11-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3792-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3792-16-0x0000000001380000-0x00000000016CA000-memory.dmp

Filesize
3.3MB

Download
memory/3792-17-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download