Analysis
-
max time kernel
179s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 01:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09f4ec49e214c58c41ac55c01291dc51.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
09f4ec49e214c58c41ac55c01291dc51.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
09f4ec49e214c58c41ac55c01291dc51.exe
-
Size
86KB
-
MD5
09f4ec49e214c58c41ac55c01291dc51
-
SHA1
326081c19983392526dd7afba5ba1b3148c6da33
-
SHA256
cb70e988633b75031cbc4268398b15ae4abcb7aab1f0d3131217d8f99871e9f8
-
SHA512
33993bf78ed2e573de24682a268e4d9e9797385d49edf66819f44894c10d9202d915043ff7375a9d33d7e7062fccc9008557f4f6a995e348a06ed11d49822ad7
-
SSDEEP
1536:D7RGHdp0J/OWnS3WD70aYrA1VaAKF/Amip/th0joad3kjFi8/a5f:wHdeJhnS3vDrA1FKOTeou3+iJ5f
Score
3/10
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 4868 5100 WerFault.exe 88 1016 5100 WerFault.exe 88 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5100 wrote to memory of 4868 5100 09f4ec49e214c58c41ac55c01291dc51.exe 96 PID 5100 wrote to memory of 4868 5100 09f4ec49e214c58c41ac55c01291dc51.exe 96 PID 5100 wrote to memory of 4868 5100 09f4ec49e214c58c41ac55c01291dc51.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\09f4ec49e214c58c41ac55c01291dc51.exe"C:\Users\Admin\AppData\Local\Temp\09f4ec49e214c58c41ac55c01291dc51.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 4442⤵
- Program crash
PID:4868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 4442⤵
- Program crash
PID:1016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5100 -ip 51001⤵PID:3172