Overview
overview
10Static
static
313d2ddbb73...3e.exe
windows7-x64
313d2ddbb73...3e.exe
windows10-2004-x64
10248f6a88e2...75.exe
windows7-x64
3248f6a88e2...75.exe
windows10-2004-x64
103b3c25930d...c3.exe
windows10-2004-x64
105d4ab7321b...b1.exe
windows7-x64
35d4ab7321b...b1.exe
windows10-2004-x64
1064a91313eb...f3.exe
windows10-2004-x64
1078583cb35f...80.exe
windows10-2004-x64
107adf4e4d30...3b.exe
windows7-x64
37adf4e4d30...3b.exe
windows10-2004-x64
107eeb7d5105...82.exe
windows10-2004-x64
1085963051ec...13.exe
windows10-2004-x64
89b66df995...26.exe
windows7-x64
389b66df995...26.exe
windows10-2004-x64
108a339b5ec9...a4.exe
windows10-2004-x64
10948537d542...e0.exe
windows7-x64
3948537d542...e0.exe
windows10-2004-x64
109aaa505382...5d.exe
windows10-2004-x64
10a1fa8776d2...ff.exe
windows10-2004-x64
10a4673ac7aa...63.exe
windows7-x64
3a4673ac7aa...63.exe
windows10-2004-x64
10a6784f4b55...a5.exe
windows10-2004-x64
10c81bc7831e...44.exe
windows10-2004-x64
10db203dc135...0c.exe
windows7-x64
3db203dc135...0c.exe
windows10-2004-x64
10efd353ed4e...ec.exe
windows10-2004-x64
10Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 11:25
Static task
static1
Behavioral task
behavioral1
Sample
13d2ddbb73b782f7ef9b539d9c2f99d04cc83536205cbdf01fcfdbda6273b93e.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
13d2ddbb73b782f7ef9b539d9c2f99d04cc83536205cbdf01fcfdbda6273b93e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
248f6a88e25b649d9173c39e07ca411784d808570bec48e3d3681ea589460f75.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
248f6a88e25b649d9173c39e07ca411784d808570bec48e3d3681ea589460f75.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
3b3c25930d8e5239354b72caa7636c9cd244db255f2dbdad867a4095441c91c3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
5d4ab7321bf7b95b30cc71760a54f2de7172103b782fbdbcabcc012561d0f7b1.exe
Resource
win7-20240508-en
Behavioral task
behavioral7
Sample
5d4ab7321bf7b95b30cc71760a54f2de7172103b782fbdbcabcc012561d0f7b1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
64a91313eb50dddfb61c52017487fbcae9e2ebfc5426285d97ea6e073db0e1f3.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
78583cb35ffed4865b6cde068216b6ee82dff5cb11522d6b1b2e33d713a21f80.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
7adf4e4d30d94f50091e644399565b03649ebda511d61b6156728120df42193b.exe
Resource
win7-20240221-en
Behavioral task
behavioral11
Sample
7adf4e4d30d94f50091e644399565b03649ebda511d61b6156728120df42193b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
7eeb7d5105714891b20ada945a47c8b1144bfe9a5bfd2e9d3e958da52b062182.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
85963051ece1830904f1352feb417a21d0483c9ef3735855d49b257c6278df13.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
89b66df995df06c4b63c0874921e1da7192ea6c4fb2f7e991fb3bb68c2c25e26.exe
Resource
win7-20240508-en
Behavioral task
behavioral15
Sample
89b66df995df06c4b63c0874921e1da7192ea6c4fb2f7e991fb3bb68c2c25e26.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
8a339b5ec96af2011a66dc18e1650f9ce31815b69c4d565ca266ff41e286a1a4.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
948537d5425794f4ef3525416441d129812ac5d9ef9b35f1eacccf6948e60fe0.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
948537d5425794f4ef3525416441d129812ac5d9ef9b35f1eacccf6948e60fe0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
9aaa50538204ad8ed2bed10632de494067e88887268d3beeb1f68815b03b325d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
a1fa8776d2234540b4b06a6175a58b01a25370868f808e796d7bcbfdfeacebff.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
a6784f4b550acc54cc3376066858e706933e32e7c275b9b79acf346dc3cd3da5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral24
Sample
c81bc7831eb8bf73d67379be4d3b03944fc18873944de10d1e02f9de54dfcc44.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
db203dc135d244a9cc17433853b7a56001547d4cad091ced993ce64e9ba1250c.exe
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
db203dc135d244a9cc17433853b7a56001547d4cad091ced993ce64e9ba1250c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
efd353ed4e0d760b81c28296fd5aa7a67776e8b003d5edc1e7479f6efd721dec.exe
Resource
win10v2004-20240508-en
General
-
Target
a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe
-
Size
332KB
-
MD5
730c825ae8e2c429cba254b5e32680b7
-
SHA1
0d46cf88949e563c39cc54cca39f3d531a4c490d
-
SHA256
a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63
-
SHA512
d793da8e047dbacfe18beec057a979f27324cf01d9a68b3dc3c7271beb3311d1f630e0b06403cfe641ea9e39c65f6178e77aaf0326efaf6aaa0b57755d2c2aa2
-
SSDEEP
6144:61xw5f7Qjiz+osPz6Z520DbS1RcyghaS41temlVy5ZUOA8sb2DvvK+0Xp:6fZjs+osPz1YygYSWteCYZUOA/2H0Xp
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2548 2392 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exedescription pid Process procid_target PID 2392 wrote to memory of 2548 2392 a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe 29 PID 2392 wrote to memory of 2548 2392 a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe 29 PID 2392 wrote to memory of 2548 2392 a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe 29 PID 2392 wrote to memory of 2548 2392 a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe"C:\Users\Admin\AppData\Local\Temp\a4673ac7aa51c8f5ddda3a7edbf21cc12faacbdd4a054ee01df67f27a5332b63.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 522⤵
- Program crash
PID:2548
-