9d423777d0bf152acf13f6017af18b64462abd6f00aa7b21fac0b0270165383b | Triage

Analysis

max time kernel
90s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
08-06-2024 21:40

Sharing

Report Analysis Logs

General

Target

Silence Login.exe
Size

28KB
MD5

b7b782ba061b6fa0cdbac41272472e42
SHA1

7a4dd5691bce965d9bdf0970702669e0ab7ecd37
SHA256

9d423777d0bf152acf13f6017af18b64462abd6f00aa7b21fac0b0270165383b
SHA512

b522a3de9b0dc497ac35c456f092d22d25d328286075324c4d104fc63c00cad7cc449c78fb8bdc7c3a8c9dc60150377198bdbfe67236ed3fd86511840598027c
SSDEEP

768:zrYLWNcUMS+dD7U81oSybVJZSqKVBCtYcFwVc6K:PsScUM1dXU2oSCVyzVBuwVcl

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral2/memory/3104-1-0x00000000004A0000-0x00000000004AC000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3084 3104 WerFault.exe Silence Login.exe

C:\Users\Admin\AppData\Local\Temp\Silence Login.exe
"C:\Users\Admin\AppData\Local\Temp\Silence Login.exe"
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 884
2⤵
- Program crash
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3104 -ip 3104
1⤵
PID:2796

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3104-0-0x00000000747DE000-0x00000000747DF000-memory.dmp

Filesize
4KB

Download
memory/3104-1-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/3104-2-0x00000000747D0000-0x0000000074F81000-memory.dmp

Filesize
7.7MB

Download
memory/3104-3-0x00000000747D0000-0x0000000074F81000-memory.dmp

Filesize
7.7MB

Download