Analysis
-
max time kernel
55s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 02:02
Static task
static1
Behavioral task
behavioral1
Sample
cea8116fefb88cd3597edd342e9c0d5a99e6ff5e434035bdbb92f64c17ea2102.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cea8116fefb88cd3597edd342e9c0d5a99e6ff5e434035bdbb92f64c17ea2102.exe
Resource
win10v2004-20240419-en
General
-
Target
cea8116fefb88cd3597edd342e9c0d5a99e6ff5e434035bdbb92f64c17ea2102.exe
-
Size
452KB
-
MD5
bafe2dffe2fe76093da577a2a7763aad
-
SHA1
fe11438fbe326f3004454055a52d8e1a731521b3
-
SHA256
cea8116fefb88cd3597edd342e9c0d5a99e6ff5e434035bdbb92f64c17ea2102
-
SHA512
44af5e3ed5eb9002205ee0563ba322660ffa38a7b8d03bd2c9f54d001a52003463d77377b9e5e6bf30af8f4b88b5d404e2daa6a0c57c7cbc96d07f316d5b418d
-
SSDEEP
6144:yqLtuGCSTaLZ4Bz5iNrmY4+wqKKxsnF4rclsMoSkRywnQts4l:yWtrlXI14qdxsn7T14N4l
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2256 1624 WerFault.exe cea8116fefb88cd3597edd342e9c0d5a99e6ff5e434035bdbb92f64c17ea2102.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cea8116fefb88cd3597edd342e9c0d5a99e6ff5e434035bdbb92f64c17ea2102.exe"C:\Users\Admin\AppData\Local\Temp\cea8116fefb88cd3597edd342e9c0d5a99e6ff5e434035bdbb92f64c17ea2102.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 4562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1624 -ip 16241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1624-1-0x0000000001DB0000-0x0000000001EB0000-memory.dmpFilesize
1024KB
-
memory/1624-2-0x0000000001BA0000-0x0000000001C0D000-memory.dmpFilesize
436KB
-
memory/1624-3-0x0000000000400000-0x0000000001A3C000-memory.dmpFilesize
22.2MB
-
memory/1624-5-0x0000000001DB0000-0x0000000001EB0000-memory.dmpFilesize
1024KB
-
memory/1624-6-0x0000000000400000-0x0000000001A3C000-memory.dmpFilesize
22.2MB
-
memory/1624-9-0x0000000000400000-0x0000000001A3C000-memory.dmpFilesize
22.2MB