Analysis
-
max time kernel
24s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:18
Static task
static1
Behavioral task
behavioral1
Sample
8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe
Resource
win10v2004-20220812-en
General
-
Target
8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe
-
Size
420KB
-
MD5
1d82019ad98d3f4a710d7171d1bab625
-
SHA1
81d100669b4739339ff17bbe02bc6e7ca43cb26f
-
SHA256
8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f
-
SHA512
41b64901c21f85379ed4e7c9628968ed3537b6faf89e7b183def85e950c0d75d084315bbdf8bd963b48a0e18fa2b66333814fbc46618b7bce128aca041bc81be
-
SSDEEP
12288:ytmKz4v1nnQfevalJtPDHjXg65vYoEkf01m:lKz4vJQfWalJtHjXgWhP08
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 864 1348 WerFault.exe 8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exepid process 1348 8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exepid process 1348 8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe 1348 8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exedescription pid process target process PID 1348 wrote to memory of 864 1348 8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe WerFault.exe PID 1348 wrote to memory of 864 1348 8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe WerFault.exe PID 1348 wrote to memory of 864 1348 8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe WerFault.exe PID 1348 wrote to memory of 864 1348 8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe"C:\Users\Admin\AppData\Local\Temp\8fec024ccbda51aabb919f619863240865974cecebbf31374041709b9a32413f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 2202⤵
- Program crash
PID:864