chaos | 1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 12:29

Target

1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a.exe
Size

247KB
MD5

30856cbaaf25e2f06fda9fcbd887c7e4
SHA1

dfcfd4c6c2ac909d6ea0f61c9a449e31312cd3a5
SHA256

1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a
SHA512

ce33494215a350cf9d5fcf72f5ed6cb532bb5c905af255fdfe6d2403ca66b5f421f68446914bbee392e1db03440fb6e3a610a67c731f86ba500909908175ef8f
SSDEEP

6144:J1ndQXYM4oLhY1qqsmXHI25UstB7urbquTT:J1ndAYFolYQDiROMuRn

Score

10^/10

chaos ransomware

Chaos Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/1728-5-0x0000000000402000-0x0000000000408000-memory.dmp	family_chaos
behavioral1/memory/1728-2-0x0000000000400000-0x0000000000425000-memory.dmp	family_chaos
behavioral1/memory/1728-6-0x0000000000400000-0x0000000000425000-memory.dmp	family_chaos

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1632	1728	1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a.exe	28
PID 1728 wrote to memory of 1632	1728	1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a.exe	28
PID 1728 wrote to memory of 1632	1728	1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a.exe	28
PID 1728 wrote to memory of 1632	1728	1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a.exe	28

C:\Users\Admin\AppData\Local\Temp\1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a.exe
"C:\Users\Admin\AppData\Local\Temp\1aef2eb3dafe8098f4a261fb513c14820a3d7d4c28b58e5cd41f26d517955e7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 208
  2⤵
  - Program crash
  PID:1632

memory/1728-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1728-5-0x0000000000402000-0x0000000000408000-memory.dmp

Filesize
24KB

Download
memory/1728-1-0x0000000074FA0000-0x0000000074FEA000-memory.dmp

Filesize
296KB

Download
memory/1728-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1728-2-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1728-4-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/1728-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1728-8-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download