Analysis
- max time kernel
151s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2022, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
8934ed06e44843c67c21ee4617f76fe1f9560e5aff3aa1699e44de78ac9039b4.exe
Resource
win7-20220901-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8934ed06e44843c67c21ee4617f76fe1f9560e5aff3aa1699e44de78ac9039b4.exe
Resource
win10v2004-20221111-en
1 signatures
150 seconds
General
- Target 8934ed06e44843c67c21ee4617f76fe1f9560e5aff3aa1699e44de78ac9039b4.exe
- Size 78KB
- Sample221129-grsxaafc8z
- SHA256 8934ed06e44843c67c21ee4617f76fe1f9560e5aff3aa1699e44de78ac9039b4
- MD5 e9b2cb5922c096201a3b71b885d8636b
- SHA1 bcf07b1447af744ebed977b33c0386ff52edd9f0
- SHA512 2b9b1f1db7a914c1450b41d70f8c0d158e4a7b70942d96c4278cd674100812b3a96b9a1b95e142dd181ccdb62b8aacf68c1e09b3884097c7b408f494e952764b
- SSDEEP 384:MgITMLpWObmrZD6CMJwzkVcNI7dnXv9y/LiOEY1EE6gxuAWB3Z9:M1zrAwwIkd/wzUY6gxuAWd
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Program crash 3 IoCs
pid pid_target Process procid_target 4948 4732 WerFault.exe 82 1192 4732 WerFault.exe 82 1196 4732 WerFault.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\8934ed06e44843c67c21ee4617f76fe1f9560e5aff3aa1699e44de78ac9039b4.exe"C:\Users\Admin\AppData\Local\Temp\8934ed06e44843c67c21ee4617f76fe1f9560e5aff3aa1699e44de78ac9039b4.exe"1⤵PID:4732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 2522⤵
- Program crash
PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 2682⤵
- Program crash
PID:1192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 3042⤵
- Program crash
PID:1196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4732 -ip 47321⤵PID:2188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4732 -ip 47321⤵PID:4432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4732 -ip 47321⤵PID:4712