Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 20:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a.exe
-
Size
344KB
-
MD5
17269e9712aecf6c413bda11e1286b9e
-
SHA1
65e12e6e9c71560f831bb7940500936cf7369d0c
-
SHA256
04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a
-
SHA512
d7022294eca0f0d994ba0aef2a53fa26cae30dd9da7b2176d9266a2a5567281e6e0e56b2a2255bf6019fe3f3996b5418005130e3768e5de0459e70395ba4fd10
-
SSDEEP
6144:M38t/XuCt09AOdb0hDVe2euBRV8yHaEGFfHGz4:fHkvwh5jVR8i8IM
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2968 3032 WerFault.exe 15 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2968 3032 04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a.exe 28 PID 3032 wrote to memory of 2968 3032 04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a.exe 28 PID 3032 wrote to memory of 2968 3032 04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a.exe 28 PID 3032 wrote to memory of 2968 3032 04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a.exe"C:\Users\Admin\AppData\Local\Temp\04f1827aa1d3db8b43793eb4a75324102050e69fa6d7df1bae4d6e871da7ba4a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1522⤵
- Program crash
PID:2968
-