Overview

overview

10

Static

static

5

b539acc51a...ad.exe

windows7-x64

10

b539acc51a...ad.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    94s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-07-2024 09:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad.exe

  • Size

    1.0MB

  • MD5

    0a136df16d906821f105096987d43e11

  • SHA1

    5b4478cabb9e3d2673643235aa1980df5b2ea671

  • SHA256

    b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad

  • SHA512

    2f6b8014be9e4d2fc858fcf0b66690e3a6bc4dbd25ae7c52bd69c732dafa432b86ea6ffd45304d1fa9b58b8e6ee73ff6021a47b6158d0ea061f47c5590e812de

  • SSDEEP

    24576:AAHnh+eWsN3skA4RV1Hom2KXMmHa5R3MeYTslWVNB5:3h+ZkldoPK8Ya5R8eYSWVt

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad.exe
    "C:\Users\Admin\AppData\Local\Temp\b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad.exe"
      2⤵
        PID:3512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 696
        2⤵
        • Program crash
        PID:3608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4728 -ip 4728
      1⤵
        PID:2848

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4728-10-0x00000000026C0000-0x00000000026C4000-memory.dmp

        Filesize

        16KB

        Download