Analysis
-
max time kernel
4294181s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
25-03-2022 07:12
Static task
static1
Behavioral task
behavioral1
Sample
3048_1647779912_8762.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3048_1647779912_8762.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3048_1647779912_8762.exe
-
Size
566KB
-
MD5
556af53c178fa835be6aa971630a23c6
-
SHA1
f34c646fe356772477d4f2e4226596b8bed40cca
-
SHA256
3510aec49416b1e42f8958c4dbd7cf3b8aaa124b2a3d39cfe4829f943f67ac64
-
SHA512
d73979b5f20b1e759d695f55ff046831e715a1efd981f77af6fce572a6717656be60b36805fdb58b50592fc7d7641c8431fb5e946d8f793fb5e45ec1c0f600bc
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1920 set thread context of 1156 1920 3048_1647779912_8762.exe 29 -
Program crash 1 IoCs
pid pid_target Process procid_target 1852 1156 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1920 wrote to memory of 1156 1920 3048_1647779912_8762.exe 29 PID 1156 wrote to memory of 1852 1156 RegAsm.exe 30 PID 1156 wrote to memory of 1852 1156 RegAsm.exe 30 PID 1156 wrote to memory of 1852 1156 RegAsm.exe 30 PID 1156 wrote to memory of 1852 1156 RegAsm.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3048_1647779912_8762.exe"C:\Users\Admin\AppData\Local\Temp\3048_1647779912_8762.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 2563⤵
- Program crash
PID:1852
-
-