Analysis
-
max time kernel
182s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 02:13
Static task
static1
Behavioral task
behavioral1
Sample
f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180.exe
Resource
win10v2004-20220812-en
General
-
Target
f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180.exe
-
Size
469KB
-
MD5
367e055710aafdb153b0487b26fb0ef0
-
SHA1
c4ef0c0c9bf647893bf24d4ebcc0ce778e0afc94
-
SHA256
f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180
-
SHA512
2a7bce666dac94b7f8f0590870ad1fe952a0e71078fd6de4517fb17af991016a318cf3a00b8209676bdcbfc23af0c9c32c031358fde2ac1beafbe315d4776f8b
-
SSDEEP
12288:95k+q39RdHC+b/X3jAg82O9J9TxbWCFeMeYwqFI7W:9CltDHPj7c7NbWrMeYwqcW
Malware Config
Signatures
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4048 1708 WerFault.exe f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180.exe 1960 1708 WerFault.exe f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180.exe 212 1708 WerFault.exe f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180.exe"C:\Users\Admin\AppData\Local\Temp\f73882be9f2c415bba53237931ecb4041683acfcfa96ad9a27e7ab662684b180.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1708 -ip 17081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1708 -ip 17081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1708 -ip 17081⤵