Analysis
-
max time kernel
90s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 22:59
Behavioral task
behavioral1
Sample
2016-2-0x0000000000D00000-0x00000000014A0000-memory.exe
Resource
win7-20240319-en
2 signatures
150 seconds
General
-
Target
2016-2-0x0000000000D00000-0x00000000014A0000-memory.exe
-
Size
7.6MB
-
MD5
57b7be766c588feb013ab510fc682a93
-
SHA1
05e81418b47f9a1fd11837b53655e3fc703f20ef
-
SHA256
ce71c5cc7233b6560a1265d7827ec31c42905c33d4e110c11e57563d7d7cdb7e
-
SHA512
eff0cb6373c464a0024e57ac75d798bd559837d91f8b67ada26cbf9af2234ee3d66a53004994f88a8f3e574d783cd69ad041f98828b37a9b47f94561b7c4dddd
-
SSDEEP
98304:0FsM7fhuW6EsVI7Vq7qi0T3uLAhxAeE9ROCeeWh6qOA/pTHrpOolY3iM6iYapR:YzfhuFQzE9deZh6w/pTLpOolY3j/
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4784-0-0x0000000000110000-0x00000000008B0000-memory.dmp themida -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4548 4784 WerFault.exe 2016-2-0x0000000000D00000-0x00000000014A0000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2016-2-0x0000000000D00000-0x00000000014A0000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2016-2-0x0000000000D00000-0x00000000014A0000-memory.exe"1⤵PID:4784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 2242⤵
- Program crash
PID:4548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4784 -ip 47841⤵PID:448