Analysis
- max time kernel
4294182s - max time network
128s - platform
windows7_x64 - resource
win7-20220310-en - submitted
19/03/2022, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
9ffda38da9799981c14b3d3e25692416.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9ffda38da9799981c14b3d3e25692416.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 9ffda38da9799981c14b3d3e25692416.exe
- Size 1.1MB
- Sample220319-vcan2seafn
- SHA256 e68709e57a75e81ed749f70bea9be2815cb7c41fda90a14567927fab472efc03
- MD5 9ffda38da9799981c14b3d3e25692416
- SHA1 3d8959fe04d9e6d205118de07e0ca84bae7068c3
- SHA512 7c96b98c3613331cdbad4b02367b81ce3919390a20caa57d98fb5941f3d9f64de32cf10e76efa466b0eef02c8f6df6ade429b431305f84150522b43475a5fbd9
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 336 2004 WerFault.exe 27 - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 972 wrote to memory of 2004 972 9ffda38da9799981c14b3d3e25692416.exe 27 PID 2004 wrote to memory of 336 2004 rundll32.exe 28 PID 2004 wrote to memory of 336 2004 rundll32.exe 28 PID 2004 wrote to memory of 336 2004 rundll32.exe 28 PID 2004 wrote to memory of 336 2004 rundll32.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ffda38da9799981c14b3d3e25692416.exe"C:\Users\Admin\AppData\Local\Temp\9ffda38da9799981c14b3d3e25692416.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 2803⤵
- Program crash
PID:336
-
-