Analysis
-
max time kernel
56s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:21
Static task
static1
Behavioral task
behavioral1
Sample
c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe
Resource
win10v2004-20220812-en
General
-
Target
c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe
-
Size
66KB
-
MD5
77a1e51dfe6a1737a2c82955c18c9f33
-
SHA1
3c5436a575fa84b847c37b21967847353d6bfa4c
-
SHA256
c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a
-
SHA512
17743eb64a8d9e425c4e300e36d70db21174edca8e78577f403be104a05c5689a41ffde97dc5c3d7c8b58fcf0b4db983c1fd94a2111df795931609af4e938336
-
SSDEEP
1536:hBNEFqUxg+Zu+di9/9glanhIxAh3I7/LPK6:hBNDU+0onOr7/G
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1520 772 WerFault.exe c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exedescription pid process target process PID 772 wrote to memory of 1520 772 c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe WerFault.exe PID 772 wrote to memory of 1520 772 c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe WerFault.exe PID 772 wrote to memory of 1520 772 c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe WerFault.exe PID 772 wrote to memory of 1520 772 c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe"C:\Users\Admin\AppData\Local\Temp\c346457130c1740a8736e6070e0b331e75bc627ec8609df7149e256086d1cc9a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 362⤵
- Program crash