Analysis
-
max time kernel
37s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 02:46
Static task
static1
Behavioral task
behavioral1
Sample
ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe
-
Size
1.9MB
-
MD5
5b6b3ee51c768d0c335799d16e85f5b1
-
SHA1
604c648cffb3e2e9fb0d3712bf341bb577c8cb81
-
SHA256
ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910
-
SHA512
df0de18365acdb919ed044f399e71670157227d6e2dc0fb0425741017650c769dbcd1fb87c2259067905379afca520708a28f9d9dabe528901d2c8d64f907f96
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exedescription pid process target process PID 1768 set thread context of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exepid process 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exepid process 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exedescription pid process target process PID 1768 wrote to memory of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe PID 1768 wrote to memory of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe PID 1768 wrote to memory of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe PID 1768 wrote to memory of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe PID 1768 wrote to memory of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe PID 1768 wrote to memory of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe PID 1768 wrote to memory of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe PID 1768 wrote to memory of 1220 1768 ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe"C:\Users\Admin\AppData\Local\Temp\ed90f1c4dfa869c5f64960eaff5ea82dc33b5d18ccfb5325a55e832739374910.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\SysWOW64\WerFault.exe"2⤵