Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
26-08-2023 23:07
Behavioral task
behavioral1
Sample
2708-26-0x0000000000220000-0x0000000000611000-memory.exe
Resource
win7-20230712-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2708-26-0x0000000000220000-0x0000000000611000-memory.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
2708-26-0x0000000000220000-0x0000000000611000-memory.exe
-
Size
3.9MB
-
MD5
41240c7308ff745c847aeae3a712245e
-
SHA1
d01d1b89af046ff30147994e397d3e40a0bee7d7
-
SHA256
e879fcdac0732849a69d5bfc75ca4c3990d445a7a96cb9578cbf26dfbd1d49e0
-
SHA512
03ed3ea95933c6b9e3ba0eb3fb9033e3a10c733fa117050e117fba193c938d833afd1989a0be3463415b5a80a9c1755712ac4249bb6cf60d9d55f48d20dac5e2
-
SSDEEP
49152:YF0Z9621PG8i3MiwdfMSpKTBELiXiXhmDdZFDo02:YCZ9DpK9vSIFDo
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2100 2556 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2100 2556 2708-26-0x0000000000220000-0x0000000000611000-memory.exe 28 PID 2556 wrote to memory of 2100 2556 2708-26-0x0000000000220000-0x0000000000611000-memory.exe 28 PID 2556 wrote to memory of 2100 2556 2708-26-0x0000000000220000-0x0000000000611000-memory.exe 28 PID 2556 wrote to memory of 2100 2556 2708-26-0x0000000000220000-0x0000000000611000-memory.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2708-26-0x0000000000220000-0x0000000000611000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2708-26-0x0000000000220000-0x0000000000611000-memory.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 362⤵
- Program crash
PID:2100
-