Analysis
-
max time kernel
88s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948.exe
Resource
win10v2004-20231222-en
General
-
Target
14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948.exe
-
Size
1.7MB
-
MD5
9b5b37094fa69affd2052a899174af26
-
SHA1
fe46daa04b350745b22b795489a121d0d008463d
-
SHA256
14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948
-
SHA512
e12084e3e119f1eee28157218d1ec3cc57598ecbcc531a4202f9b9182476d0482f63b753dc56a581de4ea4dbffceee328d9c9c59544476c531f8736ef72d91fa
-
SSDEEP
24576:+hyXWXQajtMJiAEwzJ5RRk/ouyTjusoh2WIFCE6NG+lpiqFYR427TgTVpQ8TDuFv:+9MJiAEYJ5RRk/oZ0IwG+OoN2ilNY
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4024 2964 WerFault.exe 90 -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2964 14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948.exe 2964 14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948.exe 2964 14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948.exe"C:\Users\Admin\AppData\Local\Temp\14864536e5cdd5b65a10ed6e9fd7f156572bbb498ce29d64bdc93fd5e173e948.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 9722⤵
- Program crash
PID:4024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2964 -ip 29641⤵PID:4064