Analysis
-
max time kernel
141s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 05:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d54380f953e1ec9581130143c4922eb5.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d54380f953e1ec9581130143c4922eb5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
d54380f953e1ec9581130143c4922eb5.exe
-
Size
243KB
-
MD5
d54380f953e1ec9581130143c4922eb5
-
SHA1
79d16728373632ce6ff1153541f0323085069539
-
SHA256
99200990542dee7794486cd828fa4883502037d620a39be5eb16beb94085b2b2
-
SHA512
c8a6c2e1ba703a3d7c5313a6f87f81c2ba8a5302e661c84b8af2d61d7b4472c0e7e6369cbe56ef1c460b698ce6bbe78fc9229e4d4030a1a2708d310f98b4fb97
-
SSDEEP
6144:N0/4jkcyqO3YcK7fD2RysX+001urGFCbeY/B0ZiLwkTFG:W/4TyT8KRQ000UKlp+oTF
Score
3/10
Malware Config
Signatures
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3640 5000 WerFault.exe d54380f953e1ec9581130143c4922eb5.exe 3088 5000 WerFault.exe d54380f953e1ec9581130143c4922eb5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
d54380f953e1ec9581130143c4922eb5.exedescription pid process target process PID 5000 wrote to memory of 3640 5000 d54380f953e1ec9581130143c4922eb5.exe WerFault.exe PID 5000 wrote to memory of 3640 5000 d54380f953e1ec9581130143c4922eb5.exe WerFault.exe PID 5000 wrote to memory of 3640 5000 d54380f953e1ec9581130143c4922eb5.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d54380f953e1ec9581130143c4922eb5.exe"C:\Users\Admin\AppData\Local\Temp\d54380f953e1ec9581130143c4922eb5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 4242⤵
- Program crash
PID:3640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 4242⤵
- Program crash
PID:3088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5000 -ip 50001⤵PID:2968
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:2704