Analysis
-
max time kernel
7s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:19
Static task
static1
Behavioral task
behavioral1
Sample
04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe
Resource
win10v2004-20220812-en
General
-
Target
04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe
-
Size
76KB
-
MD5
a04dfb27a052002b42d49314efdbd7d5
-
SHA1
4320c80733f6084f5c3439c263042ad579fee21b
-
SHA256
04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee
-
SHA512
f46d25eac71d2e8842a56c3d250f0b2ea454e0c6da87cc274ca0a23f453fbe84aa8f26228ef802b58b4e44926dcafef0eae6ceae332e4cabef5d4ee695e4523f
-
SSDEEP
1536:GLnR1Z7Zfp8Jv0bdmweJwwb59T/G5S1HoxO5O4dbi82hW8fPL9:A/ZxpGCdmweJjr2UY4dbi8vYL9
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1612 1092 WerFault.exe 04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exedescription pid process target process PID 1092 wrote to memory of 1612 1092 04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe WerFault.exe PID 1092 wrote to memory of 1612 1092 04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe WerFault.exe PID 1092 wrote to memory of 1612 1092 04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe WerFault.exe PID 1092 wrote to memory of 1612 1092 04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe"C:\Users\Admin\AppData\Local\Temp\04287d073cc01f9bcd1f8051b09fe054a11ca35bfd580fc44cb2a766ede36fee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 362⤵
- Program crash
PID:1612