Analysis
-
max time kernel
4s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:33
Static task
static1
Behavioral task
behavioral1
Sample
dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe
Resource
win10v2004-20220812-en
General
-
Target
dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe
-
Size
67KB
-
MD5
2aee09e29eb0fc8b1e2b545dc993ca2e
-
SHA1
00a15eaa694dc82094bcdba5cd84f623f0f03c7e
-
SHA256
dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb
-
SHA512
5afe3b3dd08c57f67cb226facf29683c89bd205ba353689c9d183d7123829384bbb2ce43b1e7ee979745acb360a5595f4874ea4714a3070a195c15f29a5a31f7
-
SSDEEP
1536:xwAhKCIDaSwktZA1T50L90Zx88tOQLhN4OZQHNEvyu3wf0xt:xRsaXUy902ZxKQhKNEvyu3K0xt
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 868 1316 WerFault.exe dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exedescription pid process target process PID 1316 wrote to memory of 868 1316 dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe WerFault.exe PID 1316 wrote to memory of 868 1316 dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe WerFault.exe PID 1316 wrote to memory of 868 1316 dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe WerFault.exe PID 1316 wrote to memory of 868 1316 dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe"C:\Users\Admin\AppData\Local\Temp\dbac03b36b381b0ceaafae204b5282e45f0d134c9aa569d7fa5ed8868e119ceb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 362⤵
- Program crash