Analysis
-
max time kernel
31s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-10-2022 18:24
Static task
static1
Behavioral task
behavioral1
Sample
ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe
Resource
win10v2004-20220812-en
General
-
Target
ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe
-
Size
320KB
-
MD5
4bad1fe740348542c9bb09b3649d5990
-
SHA1
e5e211ce4a944b34b7954b4c9e50e83a3c38d907
-
SHA256
ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984
-
SHA512
06aa7481624845e6abff61fdc0b459aad974cabfc64ab8570adc177bf83900eab6fb1b57e1f8a57f33757fbb7ad0a6bf6eb1ad451f4ed6f99a19d945047cdd50
-
SSDEEP
6144:q4qrAH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:eC2EB0NxDIBuOFe7/uT
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1992 884 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 884 wrote to memory of 1992 884 ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe 27 PID 884 wrote to memory of 1992 884 ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe 27 PID 884 wrote to memory of 1992 884 ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe 27 PID 884 wrote to memory of 1992 884 ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe"C:\Users\Admin\AppData\Local\Temp\ee60712321cb1c23e210eeeae75426c1e6e5168ce0e5fea3fcaf492101c63984.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 362⤵
- Program crash
PID:1992
-