Analysis
-
max time kernel
91s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 18:42
Static task
static1
Behavioral task
behavioral1
Sample
43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe
Resource
win10v2004-20220812-en
General
-
Target
43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe
-
Size
161KB
-
MD5
5974a2ddd27259a3fb55a721b154158f
-
SHA1
c30382698912105f2e3bc8fb049fcb61195c1ea8
-
SHA256
43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf
-
SHA512
2db498b103b00eb8a3e8552ce80e75b17e6c628a884a77731cef68574f630c7103856a1682a262db15e9d6e2fb7b4f326c05ab775ef8e2c7e053022c34ffa7d5
-
SSDEEP
3072:wJ00VQHcZJ2SDbxfD8tu1LFrnIGJ5kEHNJHnXB947h+R9qILTFRNquyBXq:xe8cZJ3B8tu1pDI27N5ReAR9qILTF
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4268 1792 WerFault.exe 43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exedescription pid process target process PID 1792 wrote to memory of 384 1792 43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe cvtres.exe PID 1792 wrote to memory of 384 1792 43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe cvtres.exe PID 1792 wrote to memory of 384 1792 43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe"C:\Users\Admin\AppData\Local\Temp\43c25e49864f20e8c6497dcaa1521549cf9f569ced9399a9399cbafddf545bdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1792 -ip 17921⤵