Analysis
-
max time kernel
72s -
max time network
81s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 13:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PO17.exe
Resource
win7-20230831-en
windows7-x64
0 signatures
60 seconds
Behavioral task
behavioral2
Sample
PO17.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
1 signatures
60 seconds
General
-
Target
PO17.exe
-
Size
564KB
-
MD5
985f40672b9d8dabfa5c92d1798d88f9
-
SHA1
b1c0fc03a274f683779f863138546aa625af632a
-
SHA256
73dae925d7b1e85ea510421587f7c351ba2cb184dd3009edfd82d75ea18a3aa1
-
SHA512
371917323930466daf2df7498ad0036c97adecbf862924d0af87e380da11a7e915b985db25d78552760ae3fefcfebd74a919ef9c31944ac74a8d2998940a48d8
-
SSDEEP
12288:P2suo0ml+G/HVM3WlmbP9GkRSRIUPIQjxkD6gAoT9XYVgwv4:10ml+GdM3WlwFGcAIQN
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 748 1500 WerFault.exe PO17.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO17.exe"C:\Users\Admin\AppData\Local\Temp\PO17.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 8522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1500 -ip 15001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-0-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/1500-1-0x00000000009A0000-0x0000000000A32000-memory.dmpFilesize
584KB
-
memory/1500-2-0x0000000007E70000-0x0000000008414000-memory.dmpFilesize
5.6MB
-
memory/1500-3-0x0000000007960000-0x00000000079F2000-memory.dmpFilesize
584KB
-
memory/1500-4-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/1500-5-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB