Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 14:54
Behavioral task
behavioral1
Sample
2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe
Resource
win7-20240419-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe
-
Size
1.1MB
-
MD5
927a387befe5763dfcd641b3bb01e1fa
-
SHA1
e4d59d9eecd19468c4d82da96c41b281723f162a
-
SHA256
f7fc1ac5beb092533390584d6994c76978481af1f24b6f74016a6e7719500f7c
-
SHA512
f4a99a2789b26345191d3a897d5cde11833e6033f853497e597536dbce38f623dd6d20bec4b6291eaaf02f27601fb669a8141f8e04bbcde590d8474be86401d3
-
SSDEEP
24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/XRPOO8SKHUq7:F0dwAYZt6C31WeTPRPOhSuUq7
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3024 3000 WerFault.exe 2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exedescription pid process target process PID 3000 wrote to memory of 3024 3000 2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe WerFault.exe PID 3000 wrote to memory of 3024 3000 2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe WerFault.exe PID 3000 wrote to memory of 3024 3000 2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe WerFault.exe PID 3000 wrote to memory of 3024 3000 2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_927a387befe5763dfcd641b3bb01e1fa_stop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1922⤵
- Program crash
PID:3024