Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 19:51
Behavioral task
behavioral1
Sample
2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe
Resource
win7-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe
-
Size
155KB
-
MD5
0be6294b82ea80ff9b3a2130c0ad6ca2
-
SHA1
193d1abf00dc672cf4e0cba0d15feccdc6bc119c
-
SHA256
2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3
-
SHA512
bf1175e1faabf3fdce3b8718e199e0c2eaa88f0d1a1357d180c104507a6363fbefbc3d0fa8e3a6eb80f2c296e85935613db47a015874f811f4bec7dfde89ec42
-
SSDEEP
3072:l5K/B0toLQSNJ5lZHQsozTS+SMqqDL2/TrKLEG:lcytwtn1yTS+xqqDL6HK9
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2964 2908 WerFault.exe 2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exedescription pid process target process PID 2908 wrote to memory of 2964 2908 2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe WerFault.exe PID 2908 wrote to memory of 2964 2908 2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe WerFault.exe PID 2908 wrote to memory of 2964 2908 2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe WerFault.exe PID 2908 wrote to memory of 2964 2908 2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe"C:\Users\Admin\AppData\Local\Temp\2901e4c2c7aea16b84b2ac25d842dd4f92000c2c7627f3fb0f5eac4b07639de3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 882⤵
- Program crash
PID:2964