Overview

overview

3

Static

static

3

95d46e5659...7a.exe

windows7-x64

3

95d46e5659...7a.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    139s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 00:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    95d46e5659640c66cf8b474b2c9a287a.exe

  • Size

    382KB

  • MD5

    95d46e5659640c66cf8b474b2c9a287a

  • SHA1

    25c1892c13000caee95eb3c09170b6df96147dde

  • SHA256

    3cf9ed34e2c09aa38e4b8258e4ddb7a9b5226c382429928a59f4909aa9228c5d

  • SHA512

    c7ed7983778c7db97e7e545d0cfd469be6139f08f8919e6f5fea09770fea150d890c9923c97ad6fc143f1a9629927ce6d95a2b10b74bd1ccbd9d7417c6fee931

  • SSDEEP

    6144:WIUsIZhxuoZ5la7tMqRjazPG3cokHE2Ba3ErAdJZ4H5oAHDXi9uB+KeMLK09cUBF:W2UhxuoNa5MqR+z+3cokHEQaaAd34eAl

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95d46e5659640c66cf8b474b2c9a287a.exe
    "C:\Users\Admin\AppData\Local\Temp\95d46e5659640c66cf8b474b2c9a287a.exe"
    1⤵
      PID:332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 220
        2⤵
        • Program crash
        PID:2784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 244
        2⤵
        • Program crash
        PID:2248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 332 -ip 332
      1⤵
        PID:5012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 332 -ip 332
        1⤵
          PID:4784

        Network

        • flag-us
          DNS
          28.118.140.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          28.118.140.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          180.178.17.96.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          180.178.17.96.in-addr.arpa
          IN PTR
          Response
          180.178.17.96.in-addr.arpa
          IN PTR
          a96-17-178-180deploystaticakamaitechnologiescom
        • flag-us
          DNS
          76.32.126.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          76.32.126.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          149.220.183.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          149.220.183.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          154.239.44.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          154.239.44.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          183.142.211.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          183.142.211.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          157.123.68.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          157.123.68.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          18.31.95.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          18.31.95.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          43.229.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          43.229.111.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          6.173.189.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          6.173.189.20.in-addr.arpa
          IN PTR
          Response
        No results found
        • 8.8.8.8:53
          28.118.140.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          28.118.140.52.in-addr.arpa

        • 8.8.8.8:53
          180.178.17.96.in-addr.arpa
          dns
          72 B
           137 B
           1
          1

          DNS Request

          180.178.17.96.in-addr.arpa

        • 8.8.8.8:53
          76.32.126.40.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          76.32.126.40.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          149.220.183.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          149.220.183.52.in-addr.arpa

        • 8.8.8.8:53
          154.239.44.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          154.239.44.20.in-addr.arpa

        • 8.8.8.8:53
          183.142.211.20.in-addr.arpa
          dns
          73 B
           159 B
           1
          1

          DNS Request

          183.142.211.20.in-addr.arpa

        • 8.8.8.8:53
          157.123.68.40.in-addr.arpa
          dns
          72 B
           146 B
           1
          1

          DNS Request

          157.123.68.40.in-addr.arpa

        • 8.8.8.8:53
          18.31.95.13.in-addr.arpa
          dns
          70 B
           144 B
           1
          1

          DNS Request

          18.31.95.13.in-addr.arpa

        • 8.8.8.8:53
          43.229.111.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          43.229.111.52.in-addr.arpa

        • 8.8.8.8:53
          6.173.189.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          6.173.189.20.in-addr.arpa

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.