Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-04-2024 11:31
Static task
static1
Behavioral task
behavioral1
Sample
e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac.exe
Resource
win11-20240412-en
General
-
Target
e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac.exe
-
Size
408KB
-
MD5
9c4f3e449e1083a20aaaa473ff98deba
-
SHA1
36915cdb45b9c32630e84b7e6d38f943d8fdb16e
-
SHA256
e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac
-
SHA512
20536c3df55fae144ead0ea7522f7ea37a3a349636d80e8a109ece24dff1885b1768ceda0e2e7eb177cf0f95c423213fc320db087f7b3cd602db46e68f310349
-
SSDEEP
6144:fKtY8LWMaYCfMrcrlsvgbngUYwoYDQSUql+2wxHqTSzp5ccRVEac:fKtY8L3alfMwsojgr3Yac+t8S1Ct
Malware Config
Signatures
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2744 844 WerFault.exe e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac.exe 2092 844 WerFault.exe e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac.exe 3396 844 WerFault.exe e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac.exe"C:\Users\Admin\AppData\Local\Temp\e1446c60ff0ddce08b4545dac30f65f0e21ccab0730c197d769486ddb7c32bac.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 12362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 12562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 11722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 844 -ip 8441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 844 -ip 8441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 844 -ip 8441⤵