6ea5dc63bda788cd58bcbc5d9c736f7ba1d01371a9d05c53134616c2776c6314 | Triage

Analysis

max time kernel
91s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
27-06-2024 23:35

Sharing

Report Analysis Logs

General

Target

crypted.exe
Size

529KB
MD5

efb9f7b4e6703ad5d5b179992a6c44f8
SHA1

6f51ff5a147570a141ec8ce662501c21ff8b3530
SHA256

6ea5dc63bda788cd58bcbc5d9c736f7ba1d01371a9d05c53134616c2776c6314
SHA512

389ea1f3881434c7aabad6c9ff4827cc595afb326d978de9dbf0cfd1f80d96f9d242e11da8025970f1cf594382f01b1c86e53476d5e7896ed802dd9c018d6dc0
SSDEEP

12288:yJ8TOT7hr3MBm3CCkf3HHhBjM14MqLNyjK3h//8wr+kv:yEU7hDMg3bkf3nbjZR//8kT

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

crypted.exe

description pid process target process

PID 3052 set thread context of 2808 3052 crypted.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1868 3052 WerFault.exe crypted.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

crypted.exe

description	pid	process	target process
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe
PID 3052 wrote to memory of 2808	3052	crypted.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\crypted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 296
2⤵
- Program crash
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3052 -ip 3052
1⤵
PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-1-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2808-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2808-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3052-0-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download