Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/03/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe
-
Size
238KB
-
MD5
0ce3dc374e49433d7e15d02c015e0ee3
-
SHA1
71882bb02d1fa7b4a0f824afdcc1cd53bdb85ba1
-
SHA256
f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697
-
SHA512
a68b25bd8170205d491f3409393757eda6ec4c2b7f31e985b57a8d5fe9e876264167d2228087c6645ebd6dee6522386f9e39e631e6a7f06783f401432df730fa
-
SSDEEP
6144:hABBPmUqO791Ou5dscGTGnbpZfcATrKTJJzM5E:hABBOa90uzVWGlRmTJX
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2492 2168 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2168 wrote to memory of 3036 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 29 PID 2168 wrote to memory of 3036 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 29 PID 2168 wrote to memory of 3036 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 29 PID 2168 wrote to memory of 3036 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 29 PID 2168 wrote to memory of 3036 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 29 PID 2168 wrote to memory of 3036 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 29 PID 2168 wrote to memory of 3036 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 29 PID 2168 wrote to memory of 3036 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 29 PID 2168 wrote to memory of 2492 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 30 PID 2168 wrote to memory of 2492 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 30 PID 2168 wrote to memory of 2492 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 30 PID 2168 wrote to memory of 2492 2168 f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe"C:\Users\Admin\AppData\Local\Temp\f714adc256ed7b0d48a50c9b10d0db1d6285541801e720569c86fceeba072697.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 5042⤵
- Program crash
PID:2492
-