Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 14:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
General
-
Target
201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe
-
Size
2.5MB
-
MD5
863fd1cebb05495d4ef4bb6c7333db30
-
SHA1
b7ffae47e5526d5505435798297f9a88127aad13
-
SHA256
201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce
-
SHA512
e04a0f5872322c93bd5998913727813a3fbb5b473b717a7c2c4b65d8a0ecf79a2887a59c3110938f7671e2bea0949ec1436e8abfce69e2159b986bc4799b69d2
-
SSDEEP
49152:wb3TNXu55J28AEm85OxrGnuj7zMRmhKAGVPsuGIWFREab6PPWmfWqQm20Cu:wbhXuvJ1A0y6ujUEhwPoFREFWmfp
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2032 2232 WerFault.exe 201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exedescription pid process target process PID 2232 wrote to memory of 2032 2232 201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe WerFault.exe PID 2232 wrote to memory of 2032 2232 201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe WerFault.exe PID 2232 wrote to memory of 2032 2232 201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe WerFault.exe PID 2232 wrote to memory of 2032 2232 201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe"C:\Users\Admin\AppData\Local\Temp\201fedc349577e10792850540ecc85476a75f7fe9ee1a039c2a58ad52284e3ce.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 682⤵
- Program crash