Analysis
-
max time kernel
43s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 22:39
Static task
static1
Behavioral task
behavioral1
Sample
1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe
Resource
win10v2004-20220414-en
General
-
Target
1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe
-
Size
993KB
-
MD5
75b5205666e2e598d4cbcee02d2d9680
-
SHA1
ff703a1c3ee9ab8dbcdb15f1968005c96403810d
-
SHA256
1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5
-
SHA512
3041ab329ebf748d9635ad46264044dc96810194fce8db464ac42d6f7a006381e198cc5bb65d17664e648cfb55d977911c1f688bcac0a75edf2f821232ca98e1
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1836 1100 WerFault.exe 1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exedescription pid process target process PID 1100 wrote to memory of 1836 1100 1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe WerFault.exe PID 1100 wrote to memory of 1836 1100 1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe WerFault.exe PID 1100 wrote to memory of 1836 1100 1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe WerFault.exe PID 1100 wrote to memory of 1836 1100 1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe"C:\Users\Admin\AppData\Local\Temp\1e06c0b90f6884b1819c83f31562778a28e7e3c1d2d2bcdfe291e74a837b3ee5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1722⤵
- Program crash