Resubmissions
21-01-2024 14:52
240121-r8syqaeac7 1021-01-2024 14:51
240121-r8k8waeac5 1001-01-2024 13:55
240101-q776kscacp 10Analysis
-
max time kernel
151s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-01-2024 13:55
General
-
Target
out.exe
-
Size
436KB
-
MD5
aec0dac2b75880cd43dcf189fde97e42
-
SHA1
3159ec24c4e766ee8af2dfeda0e9d87e64e08139
-
SHA256
975bb21e0b4941b1569e968ff02b8969d53ec3e090cb3a3ae28ad629cfe2453a
-
SHA512
4bf22c844e7df5f06adc2273872216ce57881df0affe4ebacd82c8e59b911575cfe00138615ef25e83062aa5da050c5a306c9c1fafc752444396d712c9831920
-
SSDEEP
6144:i4nt4N8qyv/j2+9cN9VNzmjhlPhdUiWing72gF/qXIWHsTfoaaYt+2ZOtFEmv0L:dt4K/i+89E9Wing72gFtWW+gOEmM
Score
3/10
Malware Config
Signatures
-
Program crash 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exe"C:\Users\Admin\AppData\Local\Temp\out.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 2242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 2242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3692 -ip 36921⤵