Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:23
Static task
static1
Behavioral task
behavioral1
Sample
3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe
Resource
win10v2004-20220901-en
General
-
Target
3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe
-
Size
94KB
-
MD5
8183b69c87b9dc576072744d32afb69c
-
SHA1
fbfc2df514f468a945558ed41f17d56e361c4742
-
SHA256
3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f
-
SHA512
af4b9a441d9ef8506847191216b5421d288fe1fc6c609846fcf05b64afcf30db5a5c829520d577622ca80a5a3ef685cfac42281717e05533bbfbc4fbcf8772aa
-
SSDEEP
1536:b/pT1vIbBVA0WZ+L1DBpvBXHUVRqUmuouGsUx4c0GjuJVc4EFxVNrAa0Z+:zEPAN+NBp5cqVuGsG4cHjSfGyZ
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 980 2024 WerFault.exe 3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exedescription pid process target process PID 2024 wrote to memory of 980 2024 3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe WerFault.exe PID 2024 wrote to memory of 980 2024 3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe WerFault.exe PID 2024 wrote to memory of 980 2024 3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe WerFault.exe PID 2024 wrote to memory of 980 2024 3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe"C:\Users\Admin\AppData\Local\Temp\3f40792802c2e7931af62f4bda2713d1b6b50727c34268fcc113f0ba31836c1f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 362⤵
- Program crash
PID:980