c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594.exe
Size 1.5MB
Sample240609-ktbbssgc8w
SHA256 c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594
MD5 c6de5c8fb983fe74fc17f1a562f86e79
SHA1 a9f721eb5fbf794e59f4fff2e37c6daad065dbe5
SHA512 ccd04730557332ff47e50bf9003b572b3cdc240445d0366d7855b01c9f65bee27b1890c03e2be6dc9401d327f12a1d7d7c5223742cc5ed8ae4d851ad5a0a09f9
SSDEEP 24576:fte3AgpSu9IfpXh6qyTg2WfgQtmm5YGPJiYqAU7edXBujq:le1ku9036qy9ggQt5Ycxbxiq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	1368	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2584	1368	c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594.exe	28
PID 1368 wrote to memory of 2584	1368	c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594.exe	28
PID 1368 wrote to memory of 2584	1368	c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594.exe	28
PID 1368 wrote to memory of 2584	1368	c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594.exe	28

C:\Users\Admin\AppData\Local\Temp\c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594.exe
"C:\Users\Admin\AppData\Local\Temp\c3ed5af0a98038ab8b95872370f7eac2bd41e6cfb53a2c963c764c5e57792594.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 444
  2⤵
  - Program crash
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-1-0x0000000002590000-0x00000000026B6000-memory.dmp

Download

memory/1368-0-0x0000000002460000-0x0000000002587000-memory.dmp

Download

memory/1368-2-0x00000000026C0000-0x00000000027EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads