Analysis
-
max time kernel
145s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:33
Static task
static1
Behavioral task
behavioral1
Sample
e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe
Resource
win10v2004-20220812-en
General
-
Target
e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe
-
Size
5KB
-
MD5
adc42f78ffcf9a03fa55c4809c725cfa
-
SHA1
9c137c30ed72a3ddbc02cba00fcbc993d7231810
-
SHA256
e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488
-
SHA512
f982c09d18a6d1f254aee66b39b6e7fb0da96a0f3f4bd642ce2e9b67989c3f7b6eb092af990e8ad33ef4ade6facf32914757ee3400cc502e185ca38b158ac8bb
-
SSDEEP
96:R8L/Jp0/J4RlhLXV7DMyuIkfrcNRi64zwKvdqtwdYKpJ7DEJkpddszvA:wJIJaxdw9uRi5kmdYiBDqq
Malware Config
Signatures
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3888 5000 WerFault.exe e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe 4872 5000 WerFault.exe e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe"C:\Users\Admin\AppData\Local\Temp\e9980121afcdf89bf06612769f21006dd0975a1f38039351720df61532018488.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 2202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 2242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5000 -ip 50001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5000 -ip 50001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5000-132-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB