Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8246f422d28415bbb58d8fa3e2891817.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
General
-
Target
8246f422d28415bbb58d8fa3e2891817.exe
-
Size
582KB
-
MD5
8246f422d28415bbb58d8fa3e2891817
-
SHA1
0a7d9fa2340210aa6090be64a26385b78d13c6ef
-
SHA256
9f38ec0ae60879931f99054695285b54f0d2454990249d4672acfb568905bf91
-
SHA512
4f44bcb125b14b86f6b772d23a99338be0394d04a32839a0bc7bd0344cab785bde2529bcd01a62032f74614125718666935fa4be1d276e60ce9969200ff317f0
-
SSDEEP
12288:es7vnRmS7+nqB3visIP1z20lBoLhaByXOh7OWMsIaHqZm+Ps6:XvQSUq0sIPB20UVasX07isFHqZm+Ps6
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2180 1284 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2180 1284 8246f422d28415bbb58d8fa3e2891817.exe 29 PID 1284 wrote to memory of 2180 1284 8246f422d28415bbb58d8fa3e2891817.exe 29 PID 1284 wrote to memory of 2180 1284 8246f422d28415bbb58d8fa3e2891817.exe 29 PID 1284 wrote to memory of 2180 1284 8246f422d28415bbb58d8fa3e2891817.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\8246f422d28415bbb58d8fa3e2891817.exe"C:\Users\Admin\AppData\Local\Temp\8246f422d28415bbb58d8fa3e2891817.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 522⤵
- Program crash
PID:2180
-