bfc092b384976e97153bae0e29359461bfd65fce5ad8188d6460de57bc680eaf

Analysis

max time kernel
32s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1/5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
Size

719KB
MD5

a7d3bd55656bdc04c270315d083b59c1
SHA1

a76453791867e4aaf4cd0551b70e52ced80b3fab
SHA256

5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33
SHA512

9233bbbbaed1bafaa296ae332713d0374594443dea06df83ebc9934ae0341ac7366a91c47cdd9b0877313ad1bbbf9b747f34e7cf75a1a21816463791cfdea861
SSDEEP

12288:wY2iNiw9WMA4snu2lpaSgsDLRK8RP8dSWhdWyGLiOkV2IPePH:wY1UnH4olpaSgsDlK2PKSWnWyqiJ2q

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe

description	pid	process	target process
PID 1048 set thread context of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1808 1760 WerFault.exe 5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe

pid process

1760 5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe

pid	pid_target	process	target process
1808	1760	WerFault.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe

pid	process
1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe

description	pid	process	target process
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
PID 1048 wrote to memory of 1760	1048	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
PID 1760 wrote to memory of 1808	1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	WerFault.exe
PID 1760 wrote to memory of 1808	1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	WerFault.exe
PID 1760 wrote to memory of 1808	1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	WerFault.exe
PID 1760 wrote to memory of 1808	1760	5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1\5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
"C:\Users\Admin\AppData\Local\Temp\1\5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\1\5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
  "C:\Users\Admin\AppData\Local\Temp\1\5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 36
    3⤵
    - Program crash
    PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-11-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1048-1-0x0000000000C00000-0x0000000000CBA000-memory.dmp

Filesize
744KB

Download
memory/1048-2-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1048-3-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/1048-4-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/1048-5-0x00000000052F0000-0x000000000537E000-memory.dmp

Filesize
568KB

Download
memory/1048-0-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/1760-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1760-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-13-0x0000000000CC0000-0x0000000000FC3000-memory.dmp

Filesize
3.0MB

Download
memory/1760-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download