d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174

Analysis

max time kernel
137s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe
Size

959KB
MD5

f5b20b005cbb604eec709f984166ca68
SHA1

6dc9f3042ae2074c22e0aaf2e3e3219ff90e5e94
SHA256

d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174
SHA512

3602275f7ac78d2535f46ad2be0654ff8f1d653e29a66a1d59c46c629a53172edb1788384df5baebfd30208a3e71f05e153463ba753bc4f8306a4177d8f371f1
SSDEEP

12288:DhX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBa7ds/VtbTUsvExU:h0DUY7TsfdHaoUR818CyPYA/bIzO9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 2904	4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe	99

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	2904	WerFault.exe	99

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe
4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe
2904	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe
2904	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2904	4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe	99
PID 4180 wrote to memory of 2904	4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe	99
PID 4180 wrote to memory of 2904	4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe	99
PID 4180 wrote to memory of 2904	4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe	99
PID 4180 wrote to memory of 2904	4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe	99
PID 4180 wrote to memory of 2904	4180	d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe	99

C:\Users\Admin\AppData\Local\Temp\d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe
"C:\Users\Admin\AppData\Local\Temp\d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe
  "C:\Users\Admin\AppData\Local\Temp\d3f18f0a0b2c7b7f8e365b00f804f76f0b747824086c5a9530471efd1ebf5174.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 184
    3⤵
    - Program crash
    PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2904 -ip 2904
1⤵
PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2904-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2904-17-0x0000000001570000-0x00000000018BA000-memory.dmp

Filesize
3.3MB

Download
memory/4180-8-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/4180-9-0x000000007467E000-0x000000007467F000-memory.dmp

Filesize
4KB

Download
memory/4180-4-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/4180-5-0x0000000006320000-0x0000000006364000-memory.dmp

Filesize
272KB

Download
memory/4180-6-0x0000000006450000-0x00000000064E2000-memory.dmp

Filesize
584KB

Download
memory/4180-7-0x00000000066E0000-0x00000000066EA000-memory.dmp

Filesize
40KB

Download
memory/4180-0-0x000000007467E000-0x000000007467F000-memory.dmp

Filesize
4KB

Download
memory/4180-3-0x0000000005820000-0x0000000005DC4000-memory.dmp

Filesize
5.6MB

Download
memory/4180-10-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/4180-11-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/4180-12-0x0000000006250000-0x000000000626A000-memory.dmp

Filesize
104KB

Download
memory/4180-13-0x00000000062B0000-0x00000000062B6000-memory.dmp

Filesize
24KB

Download
memory/4180-2-0x0000000005140000-0x00000000051DC000-memory.dmp

Filesize
624KB

Download
memory/4180-16-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/4180-1-0x0000000000290000-0x0000000000386000-memory.dmp

Filesize
984KB

Download