Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 08:04
Static task
static1
Behavioral task
behavioral1
Sample
c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe
Resource
win10v2004-20220901-en
General
-
Target
c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe
-
Size
837KB
-
MD5
c4cb84946574d1805ae5bc82b3013735
-
SHA1
640ffa8f3c168d12493c68543978762ba87b1aba
-
SHA256
c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5
-
SHA512
4198f4838801bdae15b169c1e3537b8ddf6cca3f1a853defdd67c07ab29e78f72df4fed2c0e85dd01dfd2eb53928ba210d72f535f15ee292a61096959c6cddd9
-
SSDEEP
12288:Z0ghIKAW1Ggi6u5xPj0iZXNcVONq2t4RtgON46TWahpCXF8t/NJ44Z9F3Z4mxx0z:iSI2GgnCxPZqwOv46WeMyza4jQmXAzX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 988 2016 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 988 2016 c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe 27 PID 2016 wrote to memory of 988 2016 c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe 27 PID 2016 wrote to memory of 988 2016 c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe 27 PID 2016 wrote to memory of 988 2016 c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe"C:\Users\Admin\AppData\Local\Temp\c9e32022c5d4d34211bbd7605f4d59704b161f6212238aaf519c86b1d69211e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 1642⤵
- Program crash
PID:988
-