Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 10:18
Behavioral task
behavioral1
Sample
16a20a4f49eff29013a605d54db11e21.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
16a20a4f49eff29013a605d54db11e21.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
16a20a4f49eff29013a605d54db11e21.exe
-
Size
100KB
-
MD5
16a20a4f49eff29013a605d54db11e21
-
SHA1
07cfb50ba37d5cbe2e952ce138e25f5627d383d1
-
SHA256
f00b111259a8ccff69f9014d01bd102b25dcf3558431f071c000ab5c295a675c
-
SHA512
a33b7454524a45b84ee81342b21ff5ea96b08825864ca5a908e2410a7e712f2828581a83b81dbed45d4f23c3933d4e20783be8e5ae4aa707deae4994b9f67229
-
SSDEEP
1536:/sAAA3PU7pDiRhVex0SUrWTqA6ibqsCfBqk:/sAAAfGDkSdmAjbrCfBp
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3044-0-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/3044-1-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2928 3044 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2928 3044 16a20a4f49eff29013a605d54db11e21.exe 28 PID 3044 wrote to memory of 2928 3044 16a20a4f49eff29013a605d54db11e21.exe 28 PID 3044 wrote to memory of 2928 3044 16a20a4f49eff29013a605d54db11e21.exe 28 PID 3044 wrote to memory of 2928 3044 16a20a4f49eff29013a605d54db11e21.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\16a20a4f49eff29013a605d54db11e21.exe"C:\Users\Admin\AppData\Local\Temp\16a20a4f49eff29013a605d54db11e21.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1442⤵
- Program crash
PID:2928
-