Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4754eb5f31e063697c4808fc6cc96d36.exe
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4754eb5f31e063697c4808fc6cc96d36.exe
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
4754eb5f31e063697c4808fc6cc96d36.exe
-
Size
42KB
-
MD5
4754eb5f31e063697c4808fc6cc96d36
-
SHA1
df35f6958782fed9e00fc2a7f59289618e2b14e3
-
SHA256
b787e001ff945520251470f8a5bf51707bd055da6f67856675721fcdaa33ba1f
-
SHA512
5594dc9535a07b4fc54972afc14102cb713cf22d1bcc232c441b2d185494fe71a653a6fac561d613b3372e30e864b9b4ddaa2672915604d9fe1d19d8b2308cad
-
SSDEEP
768:eoIedHRo4pSiL8K8oD3L/72TcSTtc+4+MwiU5M7:eoIedRo4jQKetcciZ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2372 1652 WerFault.exe 23 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2372 1652 4754eb5f31e063697c4808fc6cc96d36.exe 28 PID 1652 wrote to memory of 2372 1652 4754eb5f31e063697c4808fc6cc96d36.exe 28 PID 1652 wrote to memory of 2372 1652 4754eb5f31e063697c4808fc6cc96d36.exe 28 PID 1652 wrote to memory of 2372 1652 4754eb5f31e063697c4808fc6cc96d36.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4754eb5f31e063697c4808fc6cc96d36.exe"C:\Users\Admin\AppData\Local\Temp\4754eb5f31e063697c4808fc6cc96d36.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 722⤵
- Program crash
PID:2372
-