Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 16:30
Behavioral task
behavioral1
Sample
9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe
Resource
win7-20240221-en
General
-
Target
9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe
-
Size
3.9MB
-
MD5
7b9672083d54cdb55856a2ca0a033157
-
SHA1
d790bb2ad9e7346dd3bbed633fb14995450f4d5f
-
SHA256
9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307
-
SHA512
5d2886433fe226dd9d0d03bd383c0507f7bb263d4734f2693ed254f7bd787ebe2e285f304badd73b84a47f70949e6d4c82e0224b3dc17f4e719d0ade63f514bf
-
SSDEEP
98304:3v842pda6D+/PjlLOlZyQipV5PRJ6YLr3k1iRTtS8:fkOpplLr3B1tB
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4956 2240 WerFault.exe 9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exedescription pid process target process PID 2240 wrote to memory of 4956 2240 9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe WerFault.exe PID 2240 wrote to memory of 4956 2240 9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe WerFault.exe PID 2240 wrote to memory of 4956 2240 9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe WerFault.exe PID 2240 wrote to memory of 4956 2240 9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe"C:\Users\Admin\AppData\Local\Temp\9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 1202⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2240-0-0x0000000000400000-0x00000000007EC000-memory.dmpFilesize
3.9MB
-
memory/2240-1-0x0000000077230000-0x0000000077277000-memory.dmpFilesize
284KB
-
memory/2240-503-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-511-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-521-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-541-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-539-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-537-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-543-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-535-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-545-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-533-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-549-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-547-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-551-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-531-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-529-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-527-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-525-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-523-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-519-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-555-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-553-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-517-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-515-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-513-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-509-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-507-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-505-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-502-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-557-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-559-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-561-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB
-
memory/2240-563-0x0000000002420000-0x0000000002531000-memory.dmpFilesize
1.1MB