Analysis
-
max time kernel
83s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2023 16:01
Behavioral task
behavioral1
Sample
d3eb8ce3b0edc1462c57986cb1756921.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3eb8ce3b0edc1462c57986cb1756921.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
d3eb8ce3b0edc1462c57986cb1756921.exe
-
Size
246KB
-
MD5
d3eb8ce3b0edc1462c57986cb1756921
-
SHA1
65dc1d0466109f9c81f74f60378d77f38c16cb78
-
SHA256
712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe
-
SHA512
caa348136983231c6a501d3c5409a4040c2ba32dfef5bc7ca963d4d2f6bdcb4b69ee473c7d0d0718e9d7aaec0a30120ab2ff04d58b91ee8b5f9b971eda8ae34e
-
SSDEEP
3072:0eSJSvFVJZxiGarNck+gLp082uSTl8vNLjPo6j6jZQwrcy5531Jr4CP3gnkIP:0UFfZxZarNckZVqPuPjjwZRFXI
Score
7/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3196-133-0x00007FF7D97F0000-0x00007FF7D9879000-memory.dmp vmprotect behavioral2/memory/3196-135-0x00007FF7D97F0000-0x00007FF7D9879000-memory.dmp vmprotect -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1920 3196 WerFault.exe d3eb8ce3b0edc1462c57986cb1756921.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3eb8ce3b0edc1462c57986cb1756921.exe"C:\Users\Admin\AppData\Local\Temp\d3eb8ce3b0edc1462c57986cb1756921.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3196 -s 2162⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 188 -p 3196 -ip 31961⤵