Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 17:25
Behavioral task
behavioral1
Sample
aaaa.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
General
-
Target
aaaa.exe
-
Size
93KB
-
MD5
ad4e2f3c8410aa7408fe3dda19a5db67
-
SHA1
0cefc167932d7d037889923536f061d4c64ee38b
-
SHA256
0d4c0d403392a31a1a2ab7b9b478ea3a89cdb14c862990a290ef20adec03437b
-
SHA512
0a191d63b7a40e4c8cf94a34ec2dceec55ca259837a31106fc6f44885a7992fd0ccab019e7122f9ed95efe7f05460354895be0a22c74230949ad874787a78ba1
-
SSDEEP
1536:gWTHVn5wa8TXvqHp6kzWgDaO3C54Gf3lagvHkMTafiyVDr1lVUQ3jy0:gWTHVn8TXvc4O3CFvlaSED1P7j/
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2132 1752 WerFault.exe aaaa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
aaaa.exedescription pid process target process PID 1752 wrote to memory of 2132 1752 aaaa.exe WerFault.exe PID 1752 wrote to memory of 2132 1752 aaaa.exe WerFault.exe PID 1752 wrote to memory of 2132 1752 aaaa.exe WerFault.exe PID 1752 wrote to memory of 2132 1752 aaaa.exe WerFault.exe