Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 19:12
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-High Star.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
RFQ-High Star.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
hzejkkd.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
hzejkkd.exe
Resource
win10v2004-20231222-en
General
-
Target
hzejkkd.exe
-
Size
261KB
-
MD5
6433e88c2c73b93e935c74e650fee81d
-
SHA1
4293beea2045cf34746a003ebe779f2302a177f5
-
SHA256
f16e83d67d23cae50e5c0b8881ff8206e4e73b026229396615d0b8bd2caec7b0
-
SHA512
f3f1d02345034397ee5e7866ec9d3638f054e4395fe82cbf79bf10e0062ae70bce4d50ffeff018392f85b4799e3bd715780b670606a1decfbe34899805563db7
-
SSDEEP
6144:C4KYr8wAStrwb6E/HtFdbr0vv5R2AJXN5WeSmkMud50:C4Ltrwb6E/HtFdbr0vv5RByeaMud5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2044 2676 WerFault.exe 70 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2628 2676 hzejkkd.exe 87 PID 2676 wrote to memory of 2628 2676 hzejkkd.exe 87 PID 2676 wrote to memory of 2628 2676 hzejkkd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\hzejkkd.exe"C:\Users\Admin\AppData\Local\Temp\hzejkkd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\hzejkkd.exe"C:\Users\Admin\AppData\Local\Temp\hzejkkd.exe"2⤵PID:2628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 5242⤵
- Program crash
PID:2044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2676 -ip 26761⤵PID:852