Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 00:11
Static task
static1
Behavioral task
behavioral1
Sample
a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe
Resource
win10v2004-20221111-en
General
-
Target
a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe
-
Size
291KB
-
MD5
9c28b113ad73ceef2a19cd2e184b1157
-
SHA1
36c2cfd31a1c3720bf981392256fab8fc983155f
-
SHA256
a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c
-
SHA512
b8464bb68f0cf70d849a13e792bf335d7adb144ad0e17834608307d0fdabe523b079d38adab0b0eab53aaaad978cbcced8ccde4852cdc852082e8100dd963943
-
SSDEEP
6144:kWb3TIf+I+nOgI79krA4pn9X5E9T85bcDkN5:kWzO+I+OqrA4pn9X5E9T8ZcG5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 840 1000 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1000 wrote to memory of 840 1000 a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe 27 PID 1000 wrote to memory of 840 1000 a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe 27 PID 1000 wrote to memory of 840 1000 a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe 27 PID 1000 wrote to memory of 840 1000 a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe"C:\Users\Admin\AppData\Local\Temp\a3b9a73ae1eabc5112b520cfce36b027546df9cd9a4a4e40eef0f21e74d9b34c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 1242⤵
- Program crash
PID:840
-