Analysis
-
max time kernel
37s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 16:47
Static task
static1
Behavioral task
behavioral1
Sample
844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
Resource
win7-20220812-en
2 signatures
150 seconds
General
-
Target
844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe
-
Size
142KB
-
MD5
04fcc30dc19ef4b80a75212e6eed46dc
-
SHA1
000721d3947af3f015fbe79e3ff61bbde8ddf280
-
SHA256
844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee
-
SHA512
1fe8f2eef44954771a0f0c82211a1f58fb609d682cbe8ca17a6afa572d9c09f6212817f57ace14e625dd87f8f10e506fdca7dd447f78ec0d5477a3e8032297fa
-
SSDEEP
3072:pNQKPWDygI0CLsICg92cnyeDr24JMvTd2/xU1TeX0mZ:pNSDygINsXg4DTUxxkmZ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1984 1452 WerFault.exe 18 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1452 wrote to memory of 1984 1452 844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe 26 PID 1452 wrote to memory of 1984 1452 844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe 26 PID 1452 wrote to memory of 1984 1452 844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe 26 PID 1452 wrote to memory of 1984 1452 844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe"C:\Users\Admin\AppData\Local\Temp\844fdf64fe61602727a3607b9f3a878c5c55b8458bc133b044fe15b0358d74ee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 1602⤵
- Program crash
PID:1984
-