Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:14
Static task
static1
Behavioral task
behavioral1
Sample
f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe
Resource
win10v2004-20240419-en
General
-
Target
f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe
-
Size
6KB
-
MD5
28e5ddae1f670b86ba2509f8348671bd
-
SHA1
571c8104a7096d36cd8a5a56da60fe257e3f5bcd
-
SHA256
f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc
-
SHA512
e184d053c9b8cbdf33523d0d3834d3863505f2bd40321f4ad7611e88dcb45408d0a5a48643d20474160c04a9b234310f5ecc98151118fdf1c9d9faa81ae7154f
-
SSDEEP
48:SVbt0S4FVgCp471Ib4Fc/38+N7DYocHa23WlTpebVetFygFI5a2oxdVoZiG/9uOO:s0mIGnFc/38+N4ZHJWSY9FI5Wq3x
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exedescription pid process target process PID 1948 wrote to memory of 2824 1948 f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe WerFault.exe PID 1948 wrote to memory of 2824 1948 f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe WerFault.exe PID 1948 wrote to memory of 2824 1948 f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe"C:\Users\Admin\AppData\Local\Temp\f67af6c7fb206a45a62287aa0a0b29713655a181fc9bab894f2331b89627dafc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1948 -s 322⤵