Analysis
-
max time kernel
21s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:20
Static task
static1
Behavioral task
behavioral1
Sample
e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe
Resource
win10v2004-20221111-en
General
-
Target
e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe
-
Size
66KB
-
MD5
2e0ab835d7053a13238e4521653a7830
-
SHA1
f7b02f2f5f829c26e9b917d213435589ac95164c
-
SHA256
e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365
-
SHA512
fe9ac5d765ae268822e4dc9e907a1108f6d4ae465423d939f1333b678ffff75c4e2c03e665ec65c829b3250dd6a4e0be2c96d7c3328c168789d60061c3207053
-
SSDEEP
1536:ei94OCCwxfYaAxd2BBlLQVawmpU1AoUaODuis3Ujww+:e3Fcagulw1AXNc3uS
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1936 952 WerFault.exe e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exedescription pid process target process PID 952 wrote to memory of 1936 952 e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe WerFault.exe PID 952 wrote to memory of 1936 952 e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe WerFault.exe PID 952 wrote to memory of 1936 952 e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe WerFault.exe PID 952 wrote to memory of 1936 952 e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe"C:\Users\Admin\AppData\Local\Temp\e572a953e09f95723b38204836d9d72605fab4186f3b07b5cab93ea049b71365.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 362⤵
- Program crash
PID:1936