Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2024, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
daa8440811c32cfd4133d49cb247623b.exe
Resource
win7-20240221-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
daa8440811c32cfd4133d49cb247623b.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
daa8440811c32cfd4133d49cb247623b.exe
-
Size
301KB
-
MD5
daa8440811c32cfd4133d49cb247623b
-
SHA1
8f5749aeb32d305b627bab4bcd131cedf80e4067
-
SHA256
ad03d6c2459c0ee88848bd587581f4dc1183017aac47a757e566e0390e727f4d
-
SHA512
9a62eca193ffdf5335f96347d231761d2b9cf52ecf0f7fe62dbc2d736f27cf799681ef4a6d950846d8f83f7404a6b217a15a0281f544294c4bd40001a7304474
-
SSDEEP
6144:jjP5IphYdBcdbUA5rAZPqH3Khs/dY9YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYTWmS:HP5zdBclUA50ZPqKs/dY9YYYYYYYYYYK
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1216 4912 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4912 wrote to memory of 4992 4912 daa8440811c32cfd4133d49cb247623b.exe 90 PID 4912 wrote to memory of 4992 4912 daa8440811c32cfd4133d49cb247623b.exe 90 PID 4912 wrote to memory of 4992 4912 daa8440811c32cfd4133d49cb247623b.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\daa8440811c32cfd4133d49cb247623b.exe"C:\Users\Admin\AppData\Local\Temp\daa8440811c32cfd4133d49cb247623b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\daa8440811c32cfd4133d49cb247623b.exe"C:\Users\Admin\AppData\Local\Temp\daa8440811c32cfd4133d49cb247623b.exe"2⤵PID:4992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 4482⤵
- Program crash
PID:1216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4912 -ip 49121⤵PID:2524