Overview

overview

3

Static

static

b012c95b12...9a.exe

windows7-x64

1

b012c95b12...9a.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    172s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 13:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b012c95b1280763096eedc1bbfeac52931db469990c13e0ece75a24b9abf499a.exe

  • Size

    80KB

  • MD5

    97ea3081f9896ebe8286c20d33e3383a

  • SHA1

    96a06e8009535b5a8b1b7803c0dbdfec8592ed49

  • SHA256

    b012c95b1280763096eedc1bbfeac52931db469990c13e0ece75a24b9abf499a

  • SHA512

    f0f104ad8be0dd2866c07e206fbf7674d4a76521c3f427f23e35faa46276afe3860a60d158f3a4e5d674248a0ab893960f0bdf998e62a7b3e1ac988d86c83aab

  • SSDEEP

    1536:2onMcQqN0mRWUi3FhZ56q9HRtoTpLrOEaeH0Ysx1xZllsJbEF6B+H/j5JuoYq:2on/NpoF5dDoTpLiEaeFsBZ4bEF6B+

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b012c95b1280763096eedc1bbfeac52931db469990c13e0ece75a24b9abf499a.exe
    "C:\Users\Admin\AppData\Local\Temp\b012c95b1280763096eedc1bbfeac52931db469990c13e0ece75a24b9abf499a.exe"
    1⤵
      PID:1796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 276
        2⤵
        • Program crash
        PID:1528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 284
        2⤵
        • Program crash
        PID:4692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1796 -ip 1796
      1⤵
        PID:4436
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1796 -ip 1796
        1⤵
          PID:4772

        Network

        • flag-unknown
          DNS
          151.122.125.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          151.122.125.40.in-addr.arpa
          IN PTR
          Response
        • flag-unknown
          DNS
          7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
          Remote address:
          8.8.8.8:53
          Request
          7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
          IN PTR
          Response
        • 52.182.141.63:443
          322 B
           7
        • 93.184.221.240:80
          322 B
           7
        • 93.184.221.240:80
          322 B
           7
        • 8.8.8.8:53
          151.122.125.40.in-addr.arpa
          dns
          73 B
           159 B
           1
          1

          DNS Request

          151.122.125.40.in-addr.arpa

        • 8.8.8.8:53
          7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
          dns
          118 B
           204 B
           1
          1

          DNS Request

          7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.