Analysis
-
max time kernel
88s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe
Resource
win10v2004-20220901-en
General
-
Target
3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe
-
Size
1.1MB
-
MD5
026e8d24ae93eb7bf56b8f224ab09ca4
-
SHA1
58bb741b43c405ff1a7630a7e4ed4b058aefb1a7
-
SHA256
3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05
-
SHA512
0c7b533683f130ef0cb00b5cd69f3538910b1593523d0b528966f9e4140e86d05e83e8b5b28000e05d19c8f0546bc76479c548a97d151a7f3b8bd32595c5d84d
-
SSDEEP
24576:SzY+5DoJCSUA6O5YJUbsDnBwK2yfkRT7Z5+i2IIC7YaEGss+o028g:f+5DkGu5Y6bGmRj+iwC7NiSF
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5032-136-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-139-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-138-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-140-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-141-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-143-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-145-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-147-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-149-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-151-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-153-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-155-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-157-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-159-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-161-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-163-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-169-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-167-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-165-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-173-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-171-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-175-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-177-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-179-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-181-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/5032-183-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Program crash 2 IoCs
pid pid_target Process procid_target 576 5032 WerFault.exe 83 4464 5032 WerFault.exe 83 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5032 3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe 5032 3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe 5032 3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe 5032 3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe 5032 3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe"C:\Users\Admin\AppData\Local\Temp\3befb85abfd405d8750890eb02a8b1044eb3f663477c85f08f37f0c5080b1f05.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 16722⤵
- Program crash
PID:576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 16642⤵
- Program crash
PID:4464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5032 -ip 50321⤵PID:212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5032 -ip 50321⤵PID:2228