Analysis
-
max time kernel
17s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:22
Static task
static1
Behavioral task
behavioral1
Sample
8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe
Resource
win10v2004-20220812-en
General
-
Target
8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe
-
Size
63KB
-
MD5
29b0f89b921366ce64a965eeb70f8879
-
SHA1
539adaa16a92c62c71c28617fcd545d845bfbf12
-
SHA256
8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d
-
SHA512
dbd7b0cd042ff91d258e2d2b7985472e71f01b5663617a28b6aebc7111229300ab39abd5ab74e5a9ec89af06c237c200174d34c24a4db5144b21e777e6d684bf
-
SSDEEP
1536:A4bpodSednDKivxlQU8dAapz5YYBYHhNV8ml20q:fbsSepTxcdAEz5YjhNp2h
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1696 1000 WerFault.exe 8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exedescription pid process target process PID 1000 wrote to memory of 1696 1000 8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe WerFault.exe PID 1000 wrote to memory of 1696 1000 8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe WerFault.exe PID 1000 wrote to memory of 1696 1000 8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe WerFault.exe PID 1000 wrote to memory of 1696 1000 8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe"C:\Users\Admin\AppData\Local\Temp\8321a3197488c29bd76a55aa68d45a32a7045244651a5bf3ce1cf298d6aa1e6d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 362⤵
- Program crash
PID:1696