Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 06:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c62ee8a2a75daa0e436c91a1a479155.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c62ee8a2a75daa0e436c91a1a479155.exe
Resource
win10v2004-20231215-en
9 signatures
150 seconds
General
-
Target
2c62ee8a2a75daa0e436c91a1a479155.exe
-
Size
52KB
-
MD5
2c62ee8a2a75daa0e436c91a1a479155
-
SHA1
2ab886b656fbf2750685fa225471865ecd21c9e2
-
SHA256
f8a03ac431ceecc76e1f3af12ea948c3da3c057b5f0449f0474d5bb02933c58f
-
SHA512
e2fb3f25b565792d7d8dff123e91e6fd28c09a86f678508855a21375043b373eca3cb6d1f2571f025f80ef18cd5a69076e3e67ef355421cdc8a7fd396dea16a7
-
SSDEEP
768:RUEMjlLXFqG2q6DXjCGNL3fn2pCrllkUz6pwN75yTJUlTdKcrKJU3mLY8:RslLVF6DXjCGBf0CrllFm+N7CCscrjkp
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1752 2032 WerFault.exe 21 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1752 2032 2c62ee8a2a75daa0e436c91a1a479155.exe 28 PID 2032 wrote to memory of 1752 2032 2c62ee8a2a75daa0e436c91a1a479155.exe 28 PID 2032 wrote to memory of 1752 2032 2c62ee8a2a75daa0e436c91a1a479155.exe 28 PID 2032 wrote to memory of 1752 2032 2c62ee8a2a75daa0e436c91a1a479155.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c62ee8a2a75daa0e436c91a1a479155.exe"C:\Users\Admin\AppData\Local\Temp\2c62ee8a2a75daa0e436c91a1a479155.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 882⤵
- Program crash
PID:1752
-