Analysis
-
max time kernel
0s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
444cedbed90c18c6bc6bbabd664955a3.exe
Resource
win7-20231129-en
3 signatures
150 seconds
General
-
Target
444cedbed90c18c6bc6bbabd664955a3.exe
-
Size
1.1MB
-
MD5
444cedbed90c18c6bc6bbabd664955a3
-
SHA1
eda7b1f198aeb0fa156405567e7abd4e3cf373a4
-
SHA256
75853849eb7f8a443c7e2c38a2482b22b543bce87ac0f738af13628b1103c1de
-
SHA512
08c931e0bb1002713215a41cb8dc881f8d5ad906a1363d67df240e3cb25a6ee53a77738ba197fc681c799a49d4777e93e121995d68ffa377a1529cacb2497113
-
SSDEEP
24576:bQJSP96tATSZst9gI2phBG3wRcrW0vi2+Y8+aj6I2Mljb/pjdD4TjaX6UnDPAKl5:bQIPEtA4sH+hBCVieQJp4T2TnT
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2496 2924 WerFault.exe 14 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2924 444cedbed90c18c6bc6bbabd664955a3.exe 2924 444cedbed90c18c6bc6bbabd664955a3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\444cedbed90c18c6bc6bbabd664955a3.exe"C:\Users\Admin\AppData\Local\Temp\444cedbed90c18c6bc6bbabd664955a3.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 8282⤵
- Program crash
PID:2496
-