Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a32d858257c0013c7f291ff9c312ead6.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a32d858257c0013c7f291ff9c312ead6.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
a32d858257c0013c7f291ff9c312ead6.exe
-
Size
466KB
-
MD5
a32d858257c0013c7f291ff9c312ead6
-
SHA1
8842a6d2e19ce562c9b87da1046b7369fae11ec4
-
SHA256
c5bec757bbcb8ba9a7b84d27b3d34717c289a5000d4b3fe307937719edfd243c
-
SHA512
ae64564957eafdb598e753d916ecf1bb655870fb5ee74dcdf1fd57f5baabd84f10a01ef1e2ef3b27fb3d907342d7d63d2dc878d5fc61e75a591654ede538995f
-
SSDEEP
12288:ul2TzR34llz14UYnaXYMhTjROuLh7SNwMGw5pia:u6oPz0nhk8ud70wMGw
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a32d858257c0013c7f291ff9c312ead6.exedescription pid process target process PID 1488 set thread context of 4896 1488 a32d858257c0013c7f291ff9c312ead6.exe a32d858257c0013c7f291ff9c312ead6.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 940 4896 WerFault.exe a32d858257c0013c7f291ff9c312ead6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a32d858257c0013c7f291ff9c312ead6.exedescription pid process target process PID 1488 wrote to memory of 4896 1488 a32d858257c0013c7f291ff9c312ead6.exe a32d858257c0013c7f291ff9c312ead6.exe PID 1488 wrote to memory of 4896 1488 a32d858257c0013c7f291ff9c312ead6.exe a32d858257c0013c7f291ff9c312ead6.exe PID 1488 wrote to memory of 4896 1488 a32d858257c0013c7f291ff9c312ead6.exe a32d858257c0013c7f291ff9c312ead6.exe PID 1488 wrote to memory of 4896 1488 a32d858257c0013c7f291ff9c312ead6.exe a32d858257c0013c7f291ff9c312ead6.exe PID 1488 wrote to memory of 4896 1488 a32d858257c0013c7f291ff9c312ead6.exe a32d858257c0013c7f291ff9c312ead6.exe PID 1488 wrote to memory of 4896 1488 a32d858257c0013c7f291ff9c312ead6.exe a32d858257c0013c7f291ff9c312ead6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a32d858257c0013c7f291ff9c312ead6.exe"C:\Users\Admin\AppData\Local\Temp\a32d858257c0013c7f291ff9c312ead6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\a32d858257c0013c7f291ff9c312ead6.exe"C:\Users\Admin\AppData\Local\Temp\a32d858257c0013c7f291ff9c312ead6.exe"2⤵PID:4896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1843⤵
- Program crash
PID:940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4896 -ip 48961⤵PID:3528