Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
Resource
win10v2004-20240508-en
General
-
Target
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe
-
Size
1.4MB
-
MD5
0b7e50b40135c3919e58a39b9a224353
-
SHA1
3e2bfa0bec42f913d52b4df5c58dac2d10a80922
-
SHA256
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24
-
SHA512
3aa4e32dce04bcc5d36fecbe722064cee6c4211806414438d34f1a9fb29862dbe022b2890efb64f490a636b5fb38dc17a65192ae29a4830633bfd69ed182708a
-
SSDEEP
24576:yn25nPkW3amy8sQxeWcktTjbJ49auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbI/DyEEEEEEEEEEEEEEEEm
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2492 1912 WerFault.exe a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exedescription pid process target process PID 1912 wrote to memory of 2492 1912 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe WerFault.exe PID 1912 wrote to memory of 2492 1912 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe WerFault.exe PID 1912 wrote to memory of 2492 1912 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe WerFault.exe PID 1912 wrote to memory of 2492 1912 a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe"C:\Users\Admin\AppData\Local\Temp\a311c064a48b99a8a79e047656e610e95234c57830be981c08b8164bb3b18d24.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 6962⤵
- Program crash