Analysis
-
max time kernel
57s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 15:01
Static task
static1
Behavioral task
behavioral1
Sample
psnstuff_x64.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
psnstuff_x64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
psnstuff_x64.exe
-
Size
2.2MB
-
MD5
0aa4da516fa478ba786b766df41dfccb
-
SHA1
bc8c2013243f8083b6e959ba1b0532af73e2c78a
-
SHA256
e456e230d3d4958d2b99f2d7ee1729afcfc9696783e23b474275f73ad3977576
-
SHA512
ee1697954839c90764ef90e4d9e9ca2312574650678578e1933ad90e3807502ed4c0f3172f9af6d2d4f8771c9eb8f8bb1b80ef4c6f345899ec1945bc8009749b
-
SSDEEP
49152:xvUCUEpBJvUCUEpBWvUCUEpBevUCUEpBsysO/661KXq3vUCUEpB:xvUCUEpBJvUCUEpBWvUCUEpBevUCUEp/
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1668 1520 WerFault.exe 26 -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1520 psnstuff_x64.exe 1520 psnstuff_x64.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1520 psnstuff_x64.exe 1520 psnstuff_x64.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1668 1520 psnstuff_x64.exe 28 PID 1520 wrote to memory of 1668 1520 psnstuff_x64.exe 28 PID 1520 wrote to memory of 1668 1520 psnstuff_x64.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\psnstuff_x64.exe"C:\Users\Admin\AppData\Local\Temp\psnstuff_x64.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1520 -s 6842⤵
- Program crash
PID:1668
-