Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe
Resource
win10v2004-20240508-en
General
-
Target
2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe
-
Size
755KB
-
MD5
ea919de39b4618e0e1f0a4edf18dd856
-
SHA1
2786cbc8daafd63483ef9a1435815a08b3a6448f
-
SHA256
2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1
-
SHA512
f05c2ab39462bba109c4dfb13ee33f0e60bb31fe3d63db9c78b003b6fe5934dc05e00fb60a29ecdd53a257719d775c0a48b8b15ed32555cc2402d34eed43b261
-
SSDEEP
12288:xKCR5leZlNR4uAm+rfofbonJ7kYBx8OGFr6c7V9mbGdn+s7ny46CykR:c+erTGtEuJ7kuqFTt+s7nN
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1208 set thread context of 776 1208 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 85 -
Program crash 1 IoCs
pid pid_target Process procid_target 2748 776 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 776 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 776 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1208 wrote to memory of 776 1208 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 85 PID 1208 wrote to memory of 776 1208 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 85 PID 1208 wrote to memory of 776 1208 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 85 PID 1208 wrote to memory of 776 1208 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 85 PID 1208 wrote to memory of 776 1208 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 85 PID 1208 wrote to memory of 776 1208 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe"C:\Users\Admin\AppData\Local\Temp\2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe"C:\Users\Admin\AppData\Local\Temp\2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 1843⤵
- Program crash
PID:2748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 776 -ip 7761⤵PID:4276