Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe
Resource
win10v2004-20230915-en
General
-
Target
d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe
-
Size
508KB
-
MD5
7cdc45bc90410af2a2e230658f217f8a
-
SHA1
0515a2346ccdd46653a6a7c9eb75321f4bd26c11
-
SHA256
d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739
-
SHA512
95b5e8127e82e2c067ad857da5a48a6af66fe26ee1f115900cf5cfaffa0099b5b8df444fc0beda07ad7bb78adca92f3e3efe943b8b5cf6d4bc8265c61acaffc4
-
SSDEEP
6144:mp+ggUaqL7bmBB+VXvup/y8NNiqxNhHt3bcBMjUeaSCBly1EfrTrPH5WKbXE80Z:S16Lpq4NiCH2BMjWT/rPZTbX
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2928 1696 WerFault.exe 17 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2928 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 30 PID 1696 wrote to memory of 2928 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 30 PID 1696 wrote to memory of 2928 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 30 PID 1696 wrote to memory of 2928 1696 d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe"C:\Users\Admin\AppData\Local\Temp\d69d730d17e30937225eb3bff9289af6f0c5c2f8428519f421853e733bb9b739.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 4962⤵
- Program crash
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD53dd80dff583544514eeb3a5ed851a519
SHA156f7324d9d4230c96d1963e7b3e02b05a6cf5c24
SHA25686cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
SHA512955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
Filesize
5KB
MD53dd80dff583544514eeb3a5ed851a519
SHA156f7324d9d4230c96d1963e7b3e02b05a6cf5c24
SHA25686cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
SHA512955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
-
Filesize
5KB
MD53dd80dff583544514eeb3a5ed851a519
SHA156f7324d9d4230c96d1963e7b3e02b05a6cf5c24
SHA25686cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
SHA512955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
-
Filesize
5KB
MD53dd80dff583544514eeb3a5ed851a519
SHA156f7324d9d4230c96d1963e7b3e02b05a6cf5c24
SHA25686cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
SHA512955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
-
Filesize
5KB
MD53dd80dff583544514eeb3a5ed851a519
SHA156f7324d9d4230c96d1963e7b3e02b05a6cf5c24
SHA25686cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
SHA512955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
-
Filesize
5KB
MD53dd80dff583544514eeb3a5ed851a519
SHA156f7324d9d4230c96d1963e7b3e02b05a6cf5c24
SHA25686cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b
SHA512955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4