Analysis
-
max time kernel
20s -
max time network
15s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 09:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CFXBypass.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
CFXBypass.exe
-
Size
490KB
-
MD5
9c9245810bad661af3d6efec543d34fd
-
SHA1
93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
-
SHA256
f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
-
SHA512
90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
-
SSDEEP
6144:3PkcFUUUQHs5TlOhDuy4VjmSO6/tU4j06xeJyCjvhsXZ4m05d0qCsfBLuWWCV/rr:3McWUUysz/NhKjJPhM4/5bV/rvgE3
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2632 1908 WerFault.exe CFXBypass.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
CFXBypass.exedescription pid process target process PID 1908 wrote to memory of 2632 1908 CFXBypass.exe WerFault.exe PID 1908 wrote to memory of 2632 1908 CFXBypass.exe WerFault.exe PID 1908 wrote to memory of 2632 1908 CFXBypass.exe WerFault.exe PID 1908 wrote to memory of 2632 1908 CFXBypass.exe WerFault.exe