Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 10:29
Static task
static1
Behavioral task
behavioral1
Sample
8734C057703087FE126636FBB1FA6B367D10E8F192307.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
8734C057703087FE126636FBB1FA6B367D10E8F192307.exe
-
Size
732KB
-
MD5
72373a16a801b46d2647eb6e2e146538
-
SHA1
1d0e360c9d24cf3c8bbbece9f43601d8abb74fc5
-
SHA256
8734c057703087fe126636fbb1fa6b367d10e8f192307987fa3d81efdf6258c1
-
SHA512
65631c8c4080493d5125c8eaac546adb45becfab653d679b54c4e3b269e0050c11fd4aa69cf073b9ecd05e2eff2f774657892fbf3e36533b850e3f019c926986
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1864 1712 WerFault.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8734C057703087FE126636FBB1FA6B367D10E8F192307.exedescription pid process target process PID 1712 wrote to memory of 1864 1712 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe WerFault.exe PID 1712 wrote to memory of 1864 1712 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe WerFault.exe PID 1712 wrote to memory of 1864 1712 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe WerFault.exe PID 1712 wrote to memory of 1864 1712 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe"C:\Users\Admin\AppData\Local\Temp\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 5402⤵
- Program crash
PID:1864