Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 12:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe
-
Size
628KB
-
MD5
afe6d7985388013e32ae388a29600ae2
-
SHA1
f8082260e1591b439fdaf2ccfe3c80ccfe9d8ea6
-
SHA256
87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329
-
SHA512
98b7d345a39c755c16ff17f167de868d7b5ab9acba40f9bb9afe34056698809a5591924c9197689fb05062ed8ea68d61a91404c8e879bad4d24e5bb544782c1c
-
SSDEEP
6144:9qqDLuK1hG/uo0luLBjUX3DPg5trMON1JIIAFwp1I40zL75grM5IEu7h95Pp3qI:AqnuKTo0YSXbg5twsoEa375Z5VgfP
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3856 3636 WerFault.exe 97 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97 PID 1840 wrote to memory of 3636 1840 87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe"C:\Users\Admin\AppData\Local\Temp\87ea2dbafe7338c46b8ff3e83d14e03bfcd8cb71a0b29b54dfd8a8691ffa2329.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 123⤵
- Program crash
PID:3856
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3636 -ip 36361⤵PID:3664