Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 16:53
Static task
static1
Behavioral task
behavioral1
Sample
b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe
Resource
win10v2004-20220812-en
General
-
Target
b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe
-
Size
330KB
-
MD5
5c9dafa20b62679ec3b5b71ea6da00d0
-
SHA1
25f68dbcce38e5b9426320c1520f8da855be06cd
-
SHA256
b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80
-
SHA512
a00dc3e22a290d85020e7221f4c01cec3880bf68f0a9f481b9a7a316448da531b00700381b6bd6f4f6fe40368e63ba6f93c1fa7705794f29116e333506d34eb5
-
SSDEEP
6144:zZXq1ISgdANDBU0BoxyBBdcqgLdE3Hj0mX6gLKL0SQch8Qr:1H1dAdBU0Gyyvaz0JgLws
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1156 1604 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1604 wrote to memory of 1156 1604 b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe 27 PID 1604 wrote to memory of 1156 1604 b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe 27 PID 1604 wrote to memory of 1156 1604 b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe 27 PID 1604 wrote to memory of 1156 1604 b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe"C:\Users\Admin\AppData\Local\Temp\b9cd90a335e08dab88366cbc76b6c52a63b7f5d01e2f88d8a0e8ebd798139a80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1682⤵
- Program crash
PID:1156
-