Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 10:08
Behavioral task
behavioral1
Sample
PCPS.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
PCPS.exe
Resource
win10v2004-20240611-en
General
-
Target
PCPS.exe
-
Size
2.8MB
-
MD5
483da837d70e72105520ea82033c49ff
-
SHA1
4339212b959c1ead23bb5cc31dcf12736ee3e1d4
-
SHA256
d9f553bfe5254e734f2c687a69d9a61f082b87c74fc03af1a51dff715a6d7e9d
-
SHA512
1501cef6c13fd7285749b27ff1f1cb7bcbd4e75543eb3b3d78da649c3603028731b361a24d724d68dc41737e550ac826baf829806a69d7a90366e1768a58d23f
-
SSDEEP
49152:B3+xTCM1oVeG0kGj/esU462SJJm0tjRU+hT9Lgr84zMG8qK7kyjF3U4RRGef++fd:BLGefGh
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
PCPS.exepid process 2944 PCPS.exe 2944 PCPS.exe 2944 PCPS.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2988 2944 WerFault.exe PCPS.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
PCPS.exedescription pid process target process PID 2944 wrote to memory of 2988 2944 PCPS.exe WerFault.exe PID 2944 wrote to memory of 2988 2944 PCPS.exe WerFault.exe PID 2944 wrote to memory of 2988 2944 PCPS.exe WerFault.exe PID 2944 wrote to memory of 2988 2944 PCPS.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PCPS.exe"C:\Users\Admin\AppData\Local\Temp\PCPS.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 6842⤵
- Program crash
PID:2988
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\Desktop\OpenPing.cmd" "1⤵PID:2864
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\Desktop\OpenPing.cmd" "1⤵PID:2744
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\Desktop\OpenPing.cmd" "1⤵PID:2788
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\PcapDotNet.Core.dllFilesize
69KB
MD545fa4315c7631b828e2871db89b3df27
SHA1f34f3a5344abbb67a21348be9eaeba7831c7333e
SHA256e580ca9c0382a8663d6bdff6e53802bd73fa8a71689d7f38521ca02269775a58
SHA5121dd74a83b0435674d61e0e752e3d671334970fd7d235203faf1791c67965eee2324a7dd18e03be575138d3c3639d106534a084c3f9a78d37ff4ff77ead4cfd96
-
memory/2944-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmpFilesize
4KB
-
memory/2944-1-0x0000000000A10000-0x0000000000CF0000-memory.dmpFilesize
2.9MB
-
memory/2944-2-0x0000000000340000-0x0000000000352000-memory.dmpFilesize
72KB
-
memory/2944-3-0x0000000000350000-0x000000000036E000-memory.dmpFilesize
120KB
-
memory/2944-4-0x0000000000370000-0x000000000037A000-memory.dmpFilesize
40KB
-
memory/2944-5-0x00000000003D0000-0x00000000003E5000-memory.dmpFilesize
84KB
-
memory/2944-10-0x0000000000610000-0x0000000000625000-memory.dmpFilesize
84KB