Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 21:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1db17cce7fad2a8aea9f04bba51a1076.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1db17cce7fad2a8aea9f04bba51a1076.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1db17cce7fad2a8aea9f04bba51a1076.exe
-
Size
693KB
-
MD5
1db17cce7fad2a8aea9f04bba51a1076
-
SHA1
e9306dbff7650a9bf3c0e83e14c69b480bb46907
-
SHA256
ffe86d2a17d379a5ee9ff1f0fd63182b0ea2767601a5aab755a26379381ff93b
-
SHA512
8cbbb53ad4de5c41f585ecd6e267b2a46f8e05e6a332d0e1b9cf9bfb325c2a3c404fe1a6b1f9c04b42086a131f2e579926da8a5beb7a3af443c3db96405acf1a
-
SSDEEP
12288:k1web+4/w8AarMvRRwb8Z0zhFgvReJnup3F3Z4mxxFDqVTVOCk:+we4t3vDwbU01Fi4uxQmXUVTzk
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3016 2928 WerFault.exe 16 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3016 2928 1db17cce7fad2a8aea9f04bba51a1076.exe 20 PID 2928 wrote to memory of 3016 2928 1db17cce7fad2a8aea9f04bba51a1076.exe 20 PID 2928 wrote to memory of 3016 2928 1db17cce7fad2a8aea9f04bba51a1076.exe 20 PID 2928 wrote to memory of 3016 2928 1db17cce7fad2a8aea9f04bba51a1076.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\1db17cce7fad2a8aea9f04bba51a1076.exe"C:\Users\Admin\AppData\Local\Temp\1db17cce7fad2a8aea9f04bba51a1076.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 2402⤵
- Program crash
PID:3016
-