Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 04:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05d0de56b8adc2012ffe976636655094.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
05d0de56b8adc2012ffe976636655094.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
05d0de56b8adc2012ffe976636655094.exe
-
Size
547KB
-
MD5
05d0de56b8adc2012ffe976636655094
-
SHA1
2ab42dca9735c68560f8fe1169e5d5c48bf04e22
-
SHA256
e406ff942ad7a6250b803b13817484578633745981a0868857e2c296bff7213b
-
SHA512
66e74ea707d6554053c7f8e9fa49ff0b5f1aea59278d99e1d577daca81ee7bc52979c3b14b38345875ed9b821c61ce21841e44fce416c767638a1e65c12173fd
-
SSDEEP
12288:vZ7iKcvOwBxujDIhEh9zgDAq5YRWLNMNDIj8Whb7ZO+:vZ7iJBkwO9z2Je8wWpU+
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2372 2980 WerFault.exe 1 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2372 2980 05d0de56b8adc2012ffe976636655094.exe 16 PID 2980 wrote to memory of 2372 2980 05d0de56b8adc2012ffe976636655094.exe 16 PID 2980 wrote to memory of 2372 2980 05d0de56b8adc2012ffe976636655094.exe 16 PID 2980 wrote to memory of 2372 2980 05d0de56b8adc2012ffe976636655094.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\05d0de56b8adc2012ffe976636655094.exe"C:\Users\Admin\AppData\Local\Temp\05d0de56b8adc2012ffe976636655094.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 1242⤵
- Program crash
PID:2372
-