Analysis
-
max time kernel
1715s -
max time network
1720s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 22:26
Static task
static1
Behavioral task
behavioral1
Sample
fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe
Resource
win7
Behavioral task
behavioral2
Sample
fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe
Resource
win7v200430
Behavioral task
behavioral3
Sample
fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe
Resource
win7
General
-
Target
fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe
-
Size
248KB
-
MD5
6649224ccdf35b911f93e536b0e69a8d
-
SHA1
eeafb2352f799ca894b2e9636fb6f73d28fab7d6
-
SHA256
fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9
-
SHA512
e5ec78ac6301b1bbda0016601d135f42f2a351e4a047531248be6fec023c28a79621596ded4a3a03dab0863b58d0bbb27d92b6ce911628c64e60ba5176ec264a
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exedescription pid process target process PID 1492 wrote to memory of 1552 1492 fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe WerFault.exe PID 1492 wrote to memory of 1552 1492 fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe WerFault.exe PID 1492 wrote to memory of 1552 1492 fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1552 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1552 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1552 1492 WerFault.exe fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe"C:\Users\Admin\AppData\Local\Temp\fe3d61acbcbd89998d1f92ff6417aa3254dd7ed493007e1c530efd5482ca1ec9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1492 -s 962⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Program crash
PID:1552