Analysis
-
max time kernel
119s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 18:33
Static task
static1
Behavioral task
behavioral1
Sample
34d120d389a444956c622166d2d7aecc.exe
Resource
win7-20231215-en
General
-
Target
34d120d389a444956c622166d2d7aecc.exe
-
Size
106KB
-
MD5
34d120d389a444956c622166d2d7aecc
-
SHA1
7d402c9b7c612dbec9906c736ef005d2ec923f00
-
SHA256
9e4d46fc1754243f15e4b548a23231598770b077641f778512ff127a3f30761c
-
SHA512
d3eb03a9899cdb9a5d909292d2af9b64b84ffdea0d3099fa9445ddde8639e6188357e04366a19531f3cc8d14237d499c8eafa1766e85179df112e2d3397e2498
-
SSDEEP
1536:R+FDoKqniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:R+FDgK71QkbstyJjCKICpC72s/mlaX
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2876 34d120d389a444956c622166d2d7aecc.exe 2876 34d120d389a444956c622166d2d7aecc.exe -
resource yara_rule behavioral1/memory/2876-3-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-2-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-1-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process 2804 2876 WerFault.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2876 34d120d389a444956c622166d2d7aecc.exe
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 1361⤵
- Program crash
PID:2804
-
C:\Users\Admin\AppData\Local\Temp\34d120d389a444956c622166d2d7aecc.exe"C:\Users\Admin\AppData\Local\Temp\34d120d389a444956c622166d2d7aecc.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
PID:2876
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55c8db74feb53d8f661844895a129b3a6
SHA18aae2a816889c9331aacd0d02fb990c1f822597b
SHA25663817fb6daf0b108c6ebcbaf68156610173b7ba9090fa3aad914225e07b5046b
SHA5128bb0a48affedf8c7c9a2fdc7393a20bafd1fe259aa592c02249e65371fd9733b5945bbd422cb370cc98c8f493867adbdbc496e3aad983fd664f267ec909ec73b
-
Filesize
5KB
MD51b565157b4c868c7a78b8abb7b11eb43
SHA1e58105d08d7ad9a481e0a2d24b7501f365f7678a
SHA256acb5f55a2a6431bdbbabd78d473df7c95265a594b30c322503799c8794710527
SHA512500ab2abd6c7767e97a4322975248d3042b1aa7be60350c77a1b9210e3cf22afdeff9d9438fd2d104b9c5aefebe084cfcc0979d61d372b910c40a1a707049b7d