Analysis
-
max time kernel
3s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe
Resource
win10v2004-20221111-en
General
-
Target
38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe
-
Size
159KB
-
MD5
4b17a57d00e5b5a7bb25ef00d05ef45b
-
SHA1
0506c0f3fd27064e753000ac3a68efcdc747f0d8
-
SHA256
38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8
-
SHA512
7babd4d5347ebcdc45d2579f2d8c934f8db26348bfb46f224072977863ae0bdd4d06b1200c7ebba3c48ffdfa1b830a1eb43056e1976e670e6647787610dfe120
-
SSDEEP
3072:eKEKmrDUskUVIKkAX/0L0rZmm1sJmvktfiHR1+aJe1mgawzxsBub861jIHxownLR:eKE5IIL7JnpRUTV5nNw89NU/fPJ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 948 1216 WerFault.exe 8 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1216 wrote to memory of 948 1216 38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe 28 PID 1216 wrote to memory of 948 1216 38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe 28 PID 1216 wrote to memory of 948 1216 38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe 28 PID 1216 wrote to memory of 948 1216 38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe"C:\Users\Admin\AppData\Local\Temp\38dac92bb2dbc2da114c8ef27e59d804624269b75d3472e575c5cb02682854e8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1402⤵
- Program crash
PID:948
-