Analysis
-
max time kernel
35s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:20
Static task
static1
Behavioral task
behavioral1
Sample
d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe
Resource
win10v2004-20220812-en
General
-
Target
d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe
-
Size
121KB
-
MD5
8daa7999cf79a1caf7582c9caf6c43ca
-
SHA1
6db7d614886406249c4a0d19afdff2f1ebc0d491
-
SHA256
d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689
-
SHA512
a868facea658ae5eebee01c1f2cadf500d8f3f53ded6b64e54272928403ab2426fad3c72186ee0d59b4ac73314433b5289637423d1640b60e54d217941fa4f08
-
SSDEEP
3072:nomdZRHDCQt32BrvIScj3znsdfTSD1GAQz:nomdfuQt32BrvZcfnsdff
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 532 1452 WerFault.exe d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exedescription pid process target process PID 1452 wrote to memory of 532 1452 d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe WerFault.exe PID 1452 wrote to memory of 532 1452 d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe WerFault.exe PID 1452 wrote to memory of 532 1452 d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe WerFault.exe PID 1452 wrote to memory of 532 1452 d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe"C:\Users\Admin\AppData\Local\Temp\d29e97d702c4f3e1b5cc5698b8e97719086b20541cd45e5ca5f85fec4c452689.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 362⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-54-0x0000000000000000-mapping.dmp