Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-03-2024 11:54
Behavioral task
behavioral1
Sample
cdff58dd01e04e8717c84790a704048e.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
cdff58dd01e04e8717c84790a704048e.exe
-
Size
28.0MB
-
MD5
cdff58dd01e04e8717c84790a704048e
-
SHA1
e3982a7a9c68bc3c1b065c6c285944b9870b8f0d
-
SHA256
68698ea23df40912c2a58b909e440f235b30a11a638c3489c54b0e7499ce9f05
-
SHA512
b2165a389e40dcb613dcc447d58cbe1c4c24f0db7d9824dea2b48feda006d10b65a9f4a9c3b289d6af641453bc91e2dfd8b048e277245d48c2827eb4677427ad
-
SSDEEP
786432:7pPP4FMWcNEqcYQkvvprmHgfMjqUe7bgjUME:dPP4ejNN7pnpruuMjqPbgE
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2104 2340 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2104 2340 cdff58dd01e04e8717c84790a704048e.exe 28 PID 2340 wrote to memory of 2104 2340 cdff58dd01e04e8717c84790a704048e.exe 28 PID 2340 wrote to memory of 2104 2340 cdff58dd01e04e8717c84790a704048e.exe 28 PID 2340 wrote to memory of 2104 2340 cdff58dd01e04e8717c84790a704048e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdff58dd01e04e8717c84790a704048e.exe"C:\Users\Admin\AppData\Local\Temp\cdff58dd01e04e8717c84790a704048e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 7962⤵
- Program crash
PID:2104
-