Analysis
-
max time kernel
132s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 03:59
Behavioral task
behavioral1
Sample
WalmartForm_San_Antonio_78218.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
WalmartForm_San_Antonio_78218.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
d0000.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
d0000.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
80000.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
80000.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
US_Airways_E-Ticket_Print_Doc.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
US_Airways_E-Ticket_Print_Doc.exe
Resource
win10v2004-20240508-en
General
-
Target
WalmartForm_San_Antonio_78218.exe
-
Size
90KB
-
MD5
d062d420e2ac73b0211afe30063807fa
-
SHA1
c3ba72fb3f48bd3b4a5fe8b04e3f8b8398e624c1
-
SHA256
f1b8a10f27cc597281bdd423fd7e9829ecbf036ebe6e7e00d054c55f01454bd8
-
SHA512
761ec98c589349e4e511fc255531c5f074b810c56b9b3cec1d9477ec383686e6b8c1d99840f67540c8e83ededc5abf573371b2743ae5a5f58c3900fe9bd8e599
-
SSDEEP
1536:eTFOnhmTIgT+jv+d6tS5s8li+C89pjIk7xpPnXv0HX0cFNFXf3FBsThnzUsHR3ey:eBTdPj22FLnIS/0HEQFIn5HRg/
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2788-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2788-2-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 5000 2788 WerFault.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\WalmartForm_San_Antonio_78218.exe"C:\Users\Admin\AppData\Local\Temp\WalmartForm_San_Antonio_78218.exe"1⤵PID:2788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 4802⤵
- Program crash
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2788 -ip 27881⤵PID:1796