Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c8130e296d940f47bb5ebe612fc4f9cb.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8130e296d940f47bb5ebe612fc4f9cb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
c8130e296d940f47bb5ebe612fc4f9cb.exe
-
Size
367KB
-
MD5
c8130e296d940f47bb5ebe612fc4f9cb
-
SHA1
095dd86290203efd6f1a3d9a973969fe26e40025
-
SHA256
5eacdd06703561a4b56edb25b791e687714bda0bfaaed9e73995a97d108d35a4
-
SHA512
ee55b4b1a0661f8643e256c5347f2913970f36e203cab418241b45faeec51ded09586c93a0bc22128659d5797a10dd8c4db12d937fdd0d8ff812fc8b4c5ea143
-
SSDEEP
6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+F:rTAOm5eyUnJmCzAXTzJR3RvK6lCwF
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1196 2020 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1196 2020 c8130e296d940f47bb5ebe612fc4f9cb.exe 28 PID 2020 wrote to memory of 1196 2020 c8130e296d940f47bb5ebe612fc4f9cb.exe 28 PID 2020 wrote to memory of 1196 2020 c8130e296d940f47bb5ebe612fc4f9cb.exe 28 PID 2020 wrote to memory of 1196 2020 c8130e296d940f47bb5ebe612fc4f9cb.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8130e296d940f47bb5ebe612fc4f9cb.exe"C:\Users\Admin\AppData\Local\Temp\c8130e296d940f47bb5ebe612fc4f9cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1162⤵
- Program crash
PID:1196
-