Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 01:50
Behavioral task
behavioral1
Sample
712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe
Resource
win10v2004-20230220-en
General
-
Target
712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe
-
Size
246KB
-
MD5
d3eb8ce3b0edc1462c57986cb1756921
-
SHA1
65dc1d0466109f9c81f74f60378d77f38c16cb78
-
SHA256
712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe
-
SHA512
caa348136983231c6a501d3c5409a4040c2ba32dfef5bc7ca963d4d2f6bdcb4b69ee473c7d0d0718e9d7aaec0a30120ab2ff04d58b91ee8b5f9b971eda8ae34e
-
SSDEEP
3072:0eSJSvFVJZxiGarNck+gLp082uSTl8vNLjPo6j6jZQwrcy5531Jr4CP3gnkIP:0UFfZxZarNckZVqPuPjjwZRFXI
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1712-54-0x000000013F520000-0x000000013F5A9000-memory.dmp vmprotect behavioral1/memory/1712-56-0x000000013F520000-0x000000013F5A9000-memory.dmp vmprotect -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1704 1712 WerFault.exe 712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exedescription pid process target process PID 1712 wrote to memory of 1704 1712 712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe WerFault.exe PID 1712 wrote to memory of 1704 1712 712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe WerFault.exe PID 1712 wrote to memory of 1704 1712 712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe"C:\Users\Admin\AppData\Local\Temp\712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1712 -s 682⤵
- Program crash