Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8.exe
Resource
win10v2004-20240226-en
General
-
Target
8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8.exe
-
Size
366KB
-
MD5
1fc643321386805613389f566271c1b0
-
SHA1
073263f5c40c8cdd819a94b89658004e0c3382d7
-
SHA256
8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8
-
SHA512
b757499f5185731603630a88386961fbd6ac25c7908a8336fd57ef53f1755eea5bc8a9c618d253cea977342c45f3a87b5c7919d125e4aa1a39509bfe9239b48a
-
SSDEEP
6144:maZ43Vc0WVUxOUBbsX6zWf0G+TP/XXVeXC8X3cO9bOXX3hrL:maZ43hGOFL
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2480 2364 8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8.exe 29 PID 2364 wrote to memory of 2480 2364 8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8.exe 29 PID 2364 wrote to memory of 2480 2364 8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8.exe"C:\Users\Admin\AppData\Local\Temp\8cb726e3440f085a09b45e4ef2efb43f2dbfacb93abe001bc5e31344c39badf8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2364 -s 5042⤵PID:2480
-