Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 05:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0935ef8d8e5e8a0dfb2e92c4e706bf34.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0935ef8d8e5e8a0dfb2e92c4e706bf34.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
0935ef8d8e5e8a0dfb2e92c4e706bf34.exe
-
Size
92KB
-
MD5
0935ef8d8e5e8a0dfb2e92c4e706bf34
-
SHA1
1e4737d7e6b24bc266653e803ca6d5d0f2f31333
-
SHA256
5bd3709662923af42f4199c00b67cbf9470d0f61b1250d2db87880a0805d5890
-
SHA512
3accda119515bae73b7c9cf47a18f9f821ef20e1ec972b24172f7d00766d3adc80ab9afdede37b4a25255542ccd69c89799d528c0cb425a6eaf137a99a109330
-
SSDEEP
768:ZWsw7HPGiVRLpBj3PbnsfC/uLBVSEFFoHa/ZU7rlvYbZyBtMpofeNv:WeaUFFoH6m7ribZCtC
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2868 2872 WerFault.exe 10 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2868 2872 0935ef8d8e5e8a0dfb2e92c4e706bf34.exe 28 PID 2872 wrote to memory of 2868 2872 0935ef8d8e5e8a0dfb2e92c4e706bf34.exe 28 PID 2872 wrote to memory of 2868 2872 0935ef8d8e5e8a0dfb2e92c4e706bf34.exe 28 PID 2872 wrote to memory of 2868 2872 0935ef8d8e5e8a0dfb2e92c4e706bf34.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0935ef8d8e5e8a0dfb2e92c4e706bf34.exe"C:\Users\Admin\AppData\Local\Temp\0935ef8d8e5e8a0dfb2e92c4e706bf34.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 1482⤵
- Program crash
PID:2868
-