Analysis
-
max time kernel
5s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
Resource
win10v2004-20221111-en
General
-
Target
488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe
-
Size
218KB
-
MD5
86bd5b1a7cdc9ff4bed366b70d079099
-
SHA1
0640d8923bae8025daa01c18a3cca33d998fb50b
-
SHA256
488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665
-
SHA512
b5b42249db27c254f61d0f807758ff4c8a7fb46832b185bebd2481fd456fe9830260b4d1ad4d49b57b4d7d0781aae7b0c1adb56b8bbe47239869e6e9e8893d63
-
SSDEEP
3072:jmhDbwbLVXEQCM4e3KCpKKXNlDr/8N1ZEK4ZLK2SeyhoK3kGqyDkIf6fG2WxxpBv:Sh/wVBCZhZKLgeLKteyt9wIf+SV
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2012 1244 WerFault.exe 18 -
Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{405CD8B9-3E65-4BB0-875D-A3B8247D6EE5}\ 488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{405CD8B9-3E65-4BB0-875D-A3B8247D6EE5} 488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1244 488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe 1244 488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2012 1244 488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe 28 PID 1244 wrote to memory of 2012 1244 488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe 28 PID 1244 wrote to memory of 2012 1244 488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe 28 PID 1244 wrote to memory of 2012 1244 488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe"C:\Users\Admin\AppData\Local\Temp\488863bb99bee77183813368cfa8607fff85d7709317082f848d5b7ae098a665.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 2242⤵
- Program crash
PID:2012
-