Overview
overview
10Static
static
31d059ca891...d4.exe
windows10-2004-x64
101d90edda9f...51.exe
windows7-x64
31d90edda9f...51.exe
windows10-2004-x64
101e44c41d8d...91.exe
windows10-2004-x64
101ed736973c...3e.exe
windows10-2004-x64
10559234fc52...e2.exe
windows10-2004-x64
105a4570005d...a4.exe
windows7-x64
35a4570005d...a4.exe
windows10-2004-x64
1061f1a776dc...62.exe
windows10-2004-x64
1067045db960...01.exe
windows10-2004-x64
106d684b37ca...5c.exe
windows10-2004-x64
1077cbabe9fe...cf.exe
windows7-x64
377cbabe9fe...cf.exe
windows10-2004-x64
108a73bb4899...c3.exe
windows10-2004-x64
108db3c27c31...88.exe
windows7-x64
38db3c27c31...88.exe
windows10-2004-x64
10b72cfb2517...df.exe
windows10-2004-x64
10c2ef692d84...7e.exe
windows7-x64
3c2ef692d84...7e.exe
windows10-2004-x64
10c39106a352...4e.exe
windows7-x64
10c39106a352...4e.exe
windows10-2004-x64
10ca6d56a637...da.exe
windows10-2004-x64
10db14966ca7...cb.exe
windows7-x64
10db14966ca7...cb.exe
windows10-2004-x64
10e800205bb9...fd.exe
windows7-x64
3e800205bb9...fd.exe
windows10-2004-x64
10f8a2da44f9...41.exe
windows10-2004-x64
10fc8b501a18...d3.exe
windows7-x64
3fc8b501a18...d3.exe
windows10-2004-x64
10Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
1d059ca891566e0006cb4534dc4ff845fedd1d3d468c12366e12f98a815ed7d4.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
5a4570005d13d7c9c706dbdc0cc5ee5b8dfd33f7be6a6204a95d2134e3a483a4.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
5a4570005d13d7c9c706dbdc0cc5ee5b8dfd33f7be6a6204a95d2134e3a483a4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
61f1a776dcd13885a5979397d5b945e89d26cfcfe61e000ac89070e4a45bc562.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe
Resource
win7-20240508-en
Behavioral task
behavioral13
Sample
77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
8a73bb4899be69e1a77d74c46f81ca29b85b5c67b642e09f9735dec87b8b4cc3.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
c2ef692d84f694cd08e3238ae431c5636be2dc51342782c20a577eb05217557e.exe
Resource
win7-20240220-en
Behavioral task
behavioral19
Sample
c2ef692d84f694cd08e3238ae431c5636be2dc51342782c20a577eb05217557e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e.exe
Resource
win7-20240508-en
Behavioral task
behavioral21
Sample
c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe
Resource
win7-20240220-en
General
-
Target
fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe
-
Size
1.2MB
-
MD5
1a16ee68f1207233e67c2c808805a723
-
SHA1
e2867e17c5b2cf680cf121ecfd388dc4f9380035
-
SHA256
fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3
-
SHA512
7330de14cde4232c5020944b2a21f11bb9a238762b71e0947315bbb749a749c9d1b0500a03bd8722edc3f748fbf03d3045eb6e41e101e4340c207af9c24d40b0
-
SSDEEP
24576:7OG/5S/uUaFhBylaHU3TMzhIhH4aZGjpUwMHqsOL+QX:7OGfFhBylaHy8DsON
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2016 1120 WerFault.exe fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exedescription pid process target process PID 1120 wrote to memory of 2016 1120 fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe WerFault.exe PID 1120 wrote to memory of 2016 1120 fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe WerFault.exe PID 1120 wrote to memory of 2016 1120 fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe WerFault.exe PID 1120 wrote to memory of 2016 1120 fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe"C:\Users\Admin\AppData\Local\Temp\fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1162⤵
- Program crash
PID:2016
-