Analysis
-
max time kernel
4s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe
Resource
win10v2004-20221111-en
General
-
Target
79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe
-
Size
69KB
-
MD5
30c43aa8e73aeb3c6180bc5b22b30972
-
SHA1
0fbe37d1af360aa266fbb1c11b1d5d36d85e645e
-
SHA256
79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331
-
SHA512
989bba2e3dcc36567c6f12b46176abd4403647312a5e565acfe17e72ae6ad87c716c06a6f95054aaf36a28163205f39b317a6d35b83f36b527b3df346f74fa97
-
SSDEEP
96:BEnGHNZBi35K3/0kPUYjVJrzoV/qpFL4G7bR8Z7lhbJ42bSsU+9yl:qQY35K3bPUOVJHQ2F0sbR8LhnbfUMyl
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 284 1736 WerFault.exe 16 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 284 1736 79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe 28 PID 1736 wrote to memory of 284 1736 79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe 28 PID 1736 wrote to memory of 284 1736 79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe 28 PID 1736 wrote to memory of 284 1736 79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe"C:\Users\Admin\AppData\Local\Temp\79d4c331fb28d6cf16ecd0aaf09fdcc24e2b0876b3b39e2035436349d3fe4331.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 362⤵
- Program crash
PID:284
-