Analysis
-
max time kernel
67s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2023, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe
Resource
win10v2004-20230220-en
General
-
Target
acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe
-
Size
961KB
-
MD5
f2eea2d7635ddb8269b03b53cbee58fa
-
SHA1
2f089103c6d4ef03de30e9772a7cede752e9b71a
-
SHA256
acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009
-
SHA512
dd79441761d8a7464defd5a53be7f950a4dbfbe692335b96b0b3883a55594d1db0cfe4a1266a81887f8d7a2c52ef9e1984da00dcfbf5b3dfc5046af752b64ce2
-
SSDEEP
24576:P1T7m0Xdj0d2f8Cag45rLqkJZJvK5Cvt3jNG4Ipxmznhg:P1DdgdcefJ8CVjE4scg
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 684 3260 WerFault.exe 83 -
Modifies Control Panel 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\sTimeFormat = "H:mm:ss" acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\iTime = "1" acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\iTLZero = "0" acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\iTimePrefix = "0" acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\sTime = ":" acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\sShortDate = "yyyy-MM-dd" acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\iDate = "2" acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\sDate = "-" acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe"C:\Users\Admin\AppData\Local\Temp\acf1c73e902349fdc2098328109b3053040d124bd0572ee2c2564d3f13646009.exe"1⤵
- Modifies Control Panel
PID:3260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 5882⤵
- Program crash
PID:684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3260 -ip 32601⤵PID:4700