f6001c8b8d9084654ef5f429e672257b690d651f96e3c493e2f65457b8eabea1 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 23:23

Sharing

Report Analysis Logs

General

Target

GoKuaiUpdate.exe
Size

210KB
MD5

1ef0e1153bcd55b6f56891f94066d225
SHA1

cd863f87a7a87a162087bc26f481d66122394a24
SHA256

a79104c556c0fbe425bae24c3bd8bb56c25a902a219e79fea9e28f4e695e6688
SHA512

2847869d1186da05eef1f9b498478d1ee70cfcf2e1f215f123b12a76bd9d70f065cadf562d6ce9f90099cdfe8360591c4130f8885bbf00ab7a742980a1c16a78
SSDEEP

6144:dYGVOqttWxh2duVoaPZCPZztWx1/KuaVoL:dY49diGzsD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3720	1808	WerFault.exe	81

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

GoKuaiUpdate.exe

pid	Process
1808	GoKuaiUpdate.exe
1808	GoKuaiUpdate.exe
1808	GoKuaiUpdate.exe

C:\Users\Admin\AppData\Local\Temp\GoKuaiUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\GoKuaiUpdate.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1468
  2⤵
  - Program crash
  PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1808 -ip 1808
1⤵
PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads