Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14-01-2024 14:16
Behavioral task
behavioral1
Sample
5b7376ce847ad1b5306119d1643c573e.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b7376ce847ad1b5306119d1643c573e.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
5b7376ce847ad1b5306119d1643c573e.exe
-
Size
341KB
-
MD5
5b7376ce847ad1b5306119d1643c573e
-
SHA1
678d97cd7018f2634cae0a10be80e6f6eb107be0
-
SHA256
44ba890c667f3a083a69dbf2f639a232bb8fe41ae53e1ddf55f6bbbc17f66602
-
SHA512
246385c34b996fdd6af0bf198c84f1ad6b998fa02880eed6e9f4a24c1098768363889f667b678c6ec0c00a658f754af080e14ef2afa8a5115be0f3207200b287
-
SSDEEP
6144:Y36i6htdvIydnCseroPQKvU9wPhFOXQsZrPTeoHm0HhDtdT22CpuvNJSE7V1XDXz:+6/DdQHroPTAwpwXQsBPTeoG0HhDtdC0
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2768-0-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2768-1-0x0000000000400000-0x00000000005FF000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2680 2768 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2680 2768 5b7376ce847ad1b5306119d1643c573e.exe 28 PID 2768 wrote to memory of 2680 2768 5b7376ce847ad1b5306119d1643c573e.exe 28 PID 2768 wrote to memory of 2680 2768 5b7376ce847ad1b5306119d1643c573e.exe 28 PID 2768 wrote to memory of 2680 2768 5b7376ce847ad1b5306119d1643c573e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b7376ce847ad1b5306119d1643c573e.exe"C:\Users\Admin\AppData\Local\Temp\5b7376ce847ad1b5306119d1643c573e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 1962⤵
- Program crash
PID:2680
-