Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11b274688f30c972c85c0e8737aa7727.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
11b274688f30c972c85c0e8737aa7727.exe
Resource
win10v2004-20231215-en
0 signatures
150 seconds
General
-
Target
11b274688f30c972c85c0e8737aa7727.exe
-
Size
65KB
-
MD5
11b274688f30c972c85c0e8737aa7727
-
SHA1
607b5c28869d5a52ccb8494289828f86f0b79280
-
SHA256
c73227e5d1aca000a6b2c358f33ce5e91ff3f072e38c06603c2ec6b0eba9e7b7
-
SHA512
d7761245d2a2c3c894cd49d552899955a25ff68985a7ba7edb1b973165732637e993e13930137c8ca237ffb78e156963a7a2a66ee22fec4b887519c5ea6dd35c
-
SSDEEP
1536:ln4DISp80MuBZuomVDh8WexwAyNDzqi3/0Tpc0liyZGoH:JZeZmRvVYpc0kyoo
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2980 2056 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2980 2056 11b274688f30c972c85c0e8737aa7727.exe 28 PID 2056 wrote to memory of 2980 2056 11b274688f30c972c85c0e8737aa7727.exe 28 PID 2056 wrote to memory of 2980 2056 11b274688f30c972c85c0e8737aa7727.exe 28 PID 2056 wrote to memory of 2980 2056 11b274688f30c972c85c0e8737aa7727.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\11b274688f30c972c85c0e8737aa7727.exe"C:\Users\Admin\AppData\Local\Temp\11b274688f30c972c85c0e8737aa7727.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 922⤵
- Program crash
PID:2980
-