Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/01/2024, 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59a1c0583b92f0f1121e730e52d65a0f.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
59a1c0583b92f0f1121e730e52d65a0f.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
59a1c0583b92f0f1121e730e52d65a0f.exe
-
Size
116KB
-
MD5
59a1c0583b92f0f1121e730e52d65a0f
-
SHA1
80ea982708963dfe5c2e062a965f5353f753a70a
-
SHA256
12d870659550943fc27007dd889e8657fb5fbdab31fd89ab013d0855f3375897
-
SHA512
febfb2a81daaf2eba45660aaa375cc94c21703c546e1e0de35f659a11d8df6ad7d12a5fbc56e1eecb1c880dba8add3444a9bc39fb27077beb438350540293f8b
-
SSDEEP
3072:xppFr4lZAj+5UOQacSJAvMvm1vEYfTbZo0D0HzrG59joZAjp:Xjr4YjyUOdJAccEATbZt04Fjp
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1880 624 WerFault.exe 1 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 624 wrote to memory of 1880 624 59a1c0583b92f0f1121e730e52d65a0f.exe 28 PID 624 wrote to memory of 1880 624 59a1c0583b92f0f1121e730e52d65a0f.exe 28 PID 624 wrote to memory of 1880 624 59a1c0583b92f0f1121e730e52d65a0f.exe 28 PID 624 wrote to memory of 1880 624 59a1c0583b92f0f1121e730e52d65a0f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\59a1c0583b92f0f1121e730e52d65a0f.exe"C:\Users\Admin\AppData\Local\Temp\59a1c0583b92f0f1121e730e52d65a0f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 362⤵
- Program crash
PID:1880
-