Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 13:08
Static task
static1
Behavioral task
behavioral1
Sample
b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe
Resource
win10v2004-20240226-en
General
-
Target
b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe
-
Size
1.0MB
-
MD5
a402a1b2187e025f4e8f791fb302a1e5
-
SHA1
eab8402c4c752684e5bf5f3eb6ce21ac2f8fcc74
-
SHA256
b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e
-
SHA512
bfcc79ba4a44c1e0371665f8102aae611062fc65d48b3dc1a206eb80518958ac6684fe80d6713bc40b0a942668ec6c3a76459a2d79a0aa0d191a8d13089b3843
-
SSDEEP
24576:6AHnh+eWsN3skA4RV1Hom2KXcmtcM4wkExDla+:Nh+ZkldoPKsacLwlx
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2748-0-0x00000000010E0000-0x00000000011E9000-memory.dmp autoit_exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1752 2748 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2748 wrote to memory of 1752 2748 b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe 28 PID 2748 wrote to memory of 1752 2748 b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe 28 PID 2748 wrote to memory of 1752 2748 b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe 28 PID 2748 wrote to memory of 1752 2748 b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe"C:\Users\Admin\AppData\Local\Temp\b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 2362⤵
- Program crash
PID:1752
-