Analysis
-
max time kernel
78s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 21:32
Static task
static1
Behavioral task
behavioral1
Sample
f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe
Resource
win10v2004-20221111-en
General
-
Target
f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe
-
Size
480KB
-
MD5
06d253413aa62c1eb72edb9fdc6e2a87
-
SHA1
a3d8c88b5b9709699c183925ce3ad653491aee9d
-
SHA256
f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822
-
SHA512
74eee8077764b41bb10bfdb2f8408af549951abdf9244d0c609de931ba6f847b6653d1088cb4394de875c0f23837b28f712cc4c8161a50d4127206bb669d68bb
-
SSDEEP
12288:q0aShcx7plNJAYnIKPPfpZlrySug8pG94L3st+s0u5jgbO:q0aSholNJrXdr5ug88ss0s0gEO
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 872 1524 WerFault.exe f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exedescription pid process target process PID 1524 wrote to memory of 872 1524 f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe WerFault.exe PID 1524 wrote to memory of 872 1524 f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe WerFault.exe PID 1524 wrote to memory of 872 1524 f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe"C:\Users\Admin\AppData\Local\Temp\f0ffe30cd228800ef89e93b87315c547fde5ec6e3dc8e09485b9004726bbe822.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1524 -s 5322⤵
- Program crash
PID:872