Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 04:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27c1376f8e978b45ba0bacbcd4f0601a.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
27c1376f8e978b45ba0bacbcd4f0601a.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
27c1376f8e978b45ba0bacbcd4f0601a.exe
-
Size
253KB
-
MD5
27c1376f8e978b45ba0bacbcd4f0601a
-
SHA1
82966372beab141efa90848eb167c218862ea73e
-
SHA256
3996d79f4873afa8ce9bf66bbdd8580ba95ce875ad551688af6533d702c0e22d
-
SHA512
b06383f8d10473bf8c084f3d7cc963b261ba5e6d34fc926a1e79cc644197bf423b89ba51e18d8c2b3adc73427fd80519ec6d36b1ccc94539483d66d56574d019
-
SSDEEP
6144:Ca7jmIUuKYNcD6YSdXckKlrsWx5bpXOgU6NcRrmz:eueD6YSdXzKlrLb5k6NcR4
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 1216 2364 WerFault.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2364 27c1376f8e978b45ba0bacbcd4f0601a.exe 2364 27c1376f8e978b45ba0bacbcd4f0601a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1216 2364 27c1376f8e978b45ba0bacbcd4f0601a.exe 14 PID 2364 wrote to memory of 1216 2364 27c1376f8e978b45ba0bacbcd4f0601a.exe 14 PID 2364 wrote to memory of 1216 2364 27c1376f8e978b45ba0bacbcd4f0601a.exe 14 PID 2364 wrote to memory of 1216 2364 27c1376f8e978b45ba0bacbcd4f0601a.exe 14
Processes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 3001⤵
- Program crash
PID:1216
-
C:\Users\Admin\AppData\Local\Temp\27c1376f8e978b45ba0bacbcd4f0601a.exe"C:\Users\Admin\AppData\Local\Temp\27c1376f8e978b45ba0bacbcd4f0601a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364