Analysis
-
max time kernel
41s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
02/11/2023, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe
Resource
win10v2004-20231023-en
General
-
Target
554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe
-
Size
375KB
-
MD5
fd36e16bd6a199b8289a7bdfd45de021
-
SHA1
02a6ededf69d3d4dcce52b4c1261c2a9b15cba3c
-
SHA256
554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875
-
SHA512
c2d4768de725b098dd78443de6c8f350bf366fc1c8813bce6cebf8773cd54cd470680a7b8c3399735f2ec52a71b5ab97da9e5253298ec428f07e7d6effffdc16
-
SSDEEP
6144:qaq8vzvMEQ2MQEObF6CX6pQFeE6dtRtWvOMo9g4lSpzceUD4bVZ3PSNb2b0jexOO:qaqmzvMEQ2MQEObF6CX6pQFeE6dv2AIH
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2092 1744 WerFault.exe 17 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2092 1744 554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe 29 PID 1744 wrote to memory of 2092 1744 554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe 29 PID 1744 wrote to memory of 2092 1744 554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe 29 PID 1744 wrote to memory of 2092 1744 554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe"C:\Users\Admin\AppData\Local\Temp\554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 5722⤵
- Program crash
PID:2092
-