Analysis
-
max time kernel
74s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2023, 07:56
Behavioral task
behavioral1
Sample
a0c64497d91a1176f91723beabe68fd5521a32a2531664ac5cbb02ff9abad8b4.exe
Resource
win7-20230220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0c64497d91a1176f91723beabe68fd5521a32a2531664ac5cbb02ff9abad8b4.exe
Resource
win10v2004-20230221-en
2 signatures
150 seconds
General
-
Target
a0c64497d91a1176f91723beabe68fd5521a32a2531664ac5cbb02ff9abad8b4.exe
-
Size
7.9MB
-
MD5
4c42f0902775f4798fe2a632731e4c9b
-
SHA1
030a8969eaa5ef46583811402d6839e66939413f
-
SHA256
a0c64497d91a1176f91723beabe68fd5521a32a2531664ac5cbb02ff9abad8b4
-
SHA512
1bb7d01dfc0b75bc535bb2723d6a97a41020325017036c9f65bcab33e78e670f0062f11f260074aa4e88d84ac5db3eb1deee2f2edfe6c4ff41864b84f2ca726c
-
SSDEEP
196608:A1lNa8RXSehxqJlFfyfdvZXwyuUa4pI7/u:A1ntCTfyfdvRla4pm/u
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4156-133-0x00000000003A0000-0x000000000138E000-memory.dmp vmprotect -
Program crash 1 IoCs
pid pid_target Process procid_target 1012 4156 WerFault.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0c64497d91a1176f91723beabe68fd5521a32a2531664ac5cbb02ff9abad8b4.exe"C:\Users\Admin\AppData\Local\Temp\a0c64497d91a1176f91723beabe68fd5521a32a2531664ac5cbb02ff9abad8b4.exe"1⤵PID:4156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 16242⤵
- Program crash
PID:1012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4156 -ip 41561⤵PID:4876