Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
17/02/2024, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe
Resource
win10v2004-20231215-en
General
-
Target
a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe
-
Size
43KB
-
MD5
96b7855c21a38be40a91071a3e6a836b
-
SHA1
95eed0ab1da21e614e40eb22a54572f874fee757
-
SHA256
a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168
-
SHA512
bf9e2daf2d126adc41c1760a9930afeae7dd4dd3b712d28aa349f7bb797be929ae4ddc91cf86cdf634761ca40ef819c7f77849a752cf19967c89e0752c6b67f5
-
SSDEEP
768:PhaPZMnK+75bDKRGfCaZAuCmYVbEbNXz8mVnwASFv/DgZlSu7bEFiRY:PhaynKu5bDKRGfCICXZEbFz8mVnwFDXL
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2096 1148 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1148 wrote to memory of 2096 1148 a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe 29 PID 1148 wrote to memory of 2096 1148 a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe 29 PID 1148 wrote to memory of 2096 1148 a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe 29 PID 1148 wrote to memory of 2096 1148 a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe"C:\Users\Admin\AppData\Local\Temp\a020ef28937a1415b7f901865288f6c080a7dca39bc0428e2145cd99e8ad8168.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 5562⤵
- Program crash
PID:2096
-