Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 12:29
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
file.exe
-
Size
7.0MB
-
MD5
f91e26ad117d187f3fc7bc2aeadb9c4d
-
SHA1
6cb277d592ee18700a0386e183a96535c9fa7c5a
-
SHA256
fb649af245b195baa02a4790f237b4c7dad4d9a116ab10ec5fdb9be45dbd628a
-
SHA512
30173320a736f385ed4c28cf33383487abd70d8c369dfd39863331b40b02c6f8b71eec6096ab77b61f0df9819e834900c73409f7bc03981f4bb86ffb1cb74814
-
SSDEEP
49152:EbV/PT3YubG0iYsV5TK7n46OeBIl0WS2q0GMQRZn1JUOKInVh+fg63+NSQbUFkDg:EbV/PT3luw5OeBAS2q0O1TubOSQbNjI
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1244-1-0x0000000000B90000-0x0000000001290000-memory.dmp family_zgrat_v1 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2608 1244 WerFault.exe file.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
file.exedescription pid process target process PID 1244 wrote to memory of 2608 1244 file.exe WerFault.exe PID 1244 wrote to memory of 2608 1244 file.exe WerFault.exe PID 1244 wrote to memory of 2608 1244 file.exe WerFault.exe PID 1244 wrote to memory of 2608 1244 file.exe WerFault.exe