Analysis
-
max time kernel
32s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-08-2022 20:22
Behavioral task
behavioral1
Sample
318b972f1fb82f4aeda8e87c0bd5ddd0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
318b972f1fb82f4aeda8e87c0bd5ddd0.exe
Resource
win10v2004-20220812-en
General
-
Target
318b972f1fb82f4aeda8e87c0bd5ddd0.exe
-
Size
114KB
-
MD5
318b972f1fb82f4aeda8e87c0bd5ddd0
-
SHA1
3b6d33a5d83e1647dd9ec9fd2bb5789717f448a6
-
SHA256
811122d2e28ab312d1ac572a9f01b536d692dc7a616603bd0e64976e9b21d55b
-
SHA512
2f7631a88416958c5dd877887ac62046926f916396c30cf809ba89057be64b60f9c49bf6e7cfbfde54274d67f4254a2212597e6749dfa27503bc822c38544203
-
SSDEEP
1536:HFkQITufwkfWDurilmw9BgjKu1sPPxaS4jqY:HWQITufwkeDxlPwV16PkS4jqY
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1016-56-0x00000000008F0000-0x000000000090F000-memory.dmp family_hermeticwiper -
HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2032 1016 WerFault.exe 318b972f1fb82f4aeda8e87c0bd5ddd0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
318b972f1fb82f4aeda8e87c0bd5ddd0.exedescription pid process target process PID 1016 wrote to memory of 2032 1016 318b972f1fb82f4aeda8e87c0bd5ddd0.exe WerFault.exe PID 1016 wrote to memory of 2032 1016 318b972f1fb82f4aeda8e87c0bd5ddd0.exe WerFault.exe PID 1016 wrote to memory of 2032 1016 318b972f1fb82f4aeda8e87c0bd5ddd0.exe WerFault.exe PID 1016 wrote to memory of 2032 1016 318b972f1fb82f4aeda8e87c0bd5ddd0.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\318b972f1fb82f4aeda8e87c0bd5ddd0.exe"C:\Users\Admin\AppData\Local\Temp\318b972f1fb82f4aeda8e87c0bd5ddd0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 1162⤵
- Program crash