Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2024, 08:10
Static task
static1
Behavioral task
behavioral1
Sample
5f640d0243c5c334de314d212f7b7397.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5f640d0243c5c334de314d212f7b7397.exe
Resource
win10v2004-20231215-en
General
-
Target
5f640d0243c5c334de314d212f7b7397.exe
-
Size
72KB
-
MD5
5f640d0243c5c334de314d212f7b7397
-
SHA1
6088cd1dfec312cbe5f78278a07417f2312462df
-
SHA256
e95e60e06c05560688f6ade44a1a03860e01b0c5cb09ae0802cb72019b7a0a17
-
SHA512
267cfe505e288b06673e253b855c0480de6006101adb833f279cf1cda2c5a1aa51a1113fc837e7ee148c0c0a56ca02f6a44128cb05fb2135bfd064421024587f
-
SSDEEP
1536:IJAcG2qWMagrCBCWEHOfpVR04OAocAf7MMVfEMb+KR0Nc8QsJq39:AE2qb+EqRd/AfQMVse0Nc8QsC9
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1536 1624 WerFault.exe 84 2772 1624 WerFault.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f640d0243c5c334de314d212f7b7397.exe"C:\Users\Admin\AppData\Local\Temp\5f640d0243c5c334de314d212f7b7397.exe"1⤵PID:1624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 2602⤵
- Program crash
PID:1536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 2682⤵
- Program crash
PID:2772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1624 -ip 16241⤵PID:3328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1624 -ip 16241⤵PID:3116