Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 23:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18b5317d129d634867f49243fc43b987.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
18b5317d129d634867f49243fc43b987.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
18b5317d129d634867f49243fc43b987.exe
-
Size
32KB
-
MD5
18b5317d129d634867f49243fc43b987
-
SHA1
d505525598733501267d6aa8dc65641344ed588a
-
SHA256
3d0c27b37f1fa972317724f7394afc9cf18a4d30ca185c05f99e67c793a42d66
-
SHA512
098555c97fd837d6f5ddf07660150527099f5ffb8c3bea77830134dcb3373c8c373e6572cbfcfc468d7121921e172d3e40c5074255743f6f34a2eed1453a22c7
-
SSDEEP
384:qnBlWzawGJSq/4e9q+9Qi0T2rw1YI62hIUza/R7I9bMa2Op:I9wwSLN+9Qi0eoVT6YM744+
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1556 840 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 840 wrote to memory of 1556 840 18b5317d129d634867f49243fc43b987.exe 28 PID 840 wrote to memory of 1556 840 18b5317d129d634867f49243fc43b987.exe 28 PID 840 wrote to memory of 1556 840 18b5317d129d634867f49243fc43b987.exe 28 PID 840 wrote to memory of 1556 840 18b5317d129d634867f49243fc43b987.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\18b5317d129d634867f49243fc43b987.exe"C:\Users\Admin\AppData\Local\Temp\18b5317d129d634867f49243fc43b987.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 882⤵
- Program crash
PID:1556
-