Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 01:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
760e2ed9c88d67358191cf3b0e9eee52.exe
Resource
win7-20231215-en
2 signatures
150 seconds
General
-
Target
760e2ed9c88d67358191cf3b0e9eee52.exe
-
Size
119KB
-
MD5
760e2ed9c88d67358191cf3b0e9eee52
-
SHA1
d4b3c55d1011e8d6e7e54ffd5306d28ab68c82f4
-
SHA256
e569d2e7000ee62706c583d051d6b9fd9fac395cd3f30c73469c1deac200df58
-
SHA512
0e0c99a3623b259500d932fdd932f492559134afdfde3379dfa2d66a6fd113fbe9bd5dbd218cddef586052b841f4c23f54c3ad4540cd098c4499c810f1cb4515
-
SSDEEP
3072:Pl8wOo63/9KMNvelJLFi08v3SvYQfjGWAIb:1SP9A7VwQfjGWAIb
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1052 2032 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1052 2032 760e2ed9c88d67358191cf3b0e9eee52.exe 29 PID 2032 wrote to memory of 1052 2032 760e2ed9c88d67358191cf3b0e9eee52.exe 29 PID 2032 wrote to memory of 1052 2032 760e2ed9c88d67358191cf3b0e9eee52.exe 29 PID 2032 wrote to memory of 1052 2032 760e2ed9c88d67358191cf3b0e9eee52.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\760e2ed9c88d67358191cf3b0e9eee52.exe"C:\Users\Admin\AppData\Local\Temp\760e2ed9c88d67358191cf3b0e9eee52.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1282⤵
- Program crash
PID:1052
-