Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 17:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
file.exe
-
Size
423KB
-
MD5
39f67f57d267bccc0f9c6f4bc5d75cd4
-
SHA1
ad75b384ecf80e857082aaa3f297f54e7ec03f70
-
SHA256
4d34b942e2a7c58790d6030297b691e2164b64aa1c331c78cba3768cbe946b25
-
SHA512
2b100ab001bce924d603758b1df006ff978628161d075efc7b4c83a8391ca9be134cf02d4ce7f313507eb3c2aca69d6bb9b2565c7485b63448b460b9285be324
-
SSDEEP
12288:1UH7ILtbAFuKY9tTKZEDM7yL1t+YGUH7Z5f:YItbgLODM81t+3UH7P
Score
3/10
Malware Config
Signatures
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3372 556 WerFault.exe file.exe 3096 556 WerFault.exe file.exe 1628 556 WerFault.exe file.exe 4544 556 WerFault.exe file.exe 3172 556 WerFault.exe file.exe 5020 556 WerFault.exe file.exe 2744 556 WerFault.exe file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵PID:556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 5642⤵
- Program crash
PID:3372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 6002⤵
- Program crash
PID:3096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 6922⤵
- Program crash
PID:1628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 7122⤵
- Program crash
PID:4544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 10762⤵
- Program crash
PID:3172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 4762⤵
- Program crash
PID:5020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 11202⤵
- Program crash
PID:2744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 556 -ip 5561⤵PID:2404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 556 -ip 5561⤵PID:2948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 556 -ip 5561⤵PID:1544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 556 -ip 5561⤵PID:4536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 556 -ip 5561⤵PID:2072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 556 -ip 5561⤵PID:4500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 556 -ip 5561⤵PID:4820