Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-06-2022 02:29
Static task
static1
Behavioral task
behavioral1
Sample
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe
Resource
win10v2004-20220414-en
General
-
Target
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe
-
Size
990KB
-
MD5
2908e633ef1caa87c76d224dccca4273
-
SHA1
614e4fc794f18f541bf6ea1fcc2ba7d16fb6f6b8
-
SHA256
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642
-
SHA512
597b05b132e1cf6547826072c07c7e79ea2ae69edd0d025fca654f0b352225133f34d920fa0fd8b44aff04c79a7264cc8864c5ab49534ba7d4c0fa64e51d0ad6
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1064 1644 WerFault.exe 33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exedescription pid process target process PID 1644 wrote to memory of 1064 1644 33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe WerFault.exe PID 1644 wrote to memory of 1064 1644 33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe WerFault.exe PID 1644 wrote to memory of 1064 1644 33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe WerFault.exe PID 1644 wrote to memory of 1064 1644 33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe"C:\Users\Admin\AppData\Local\Temp\33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 1722⤵
- Program crash