Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe
Resource
win10v2004-20240426-en
General
-
Target
90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe
-
Size
1.1MB
-
MD5
1e5119f638f241f9ae2e42b71ed70552
-
SHA1
531086b60f1edf74d64eeec9042d49e7c2393e38
-
SHA256
90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692
-
SHA512
6880d84d7d98429baf1472798efc57970ddcaab4bf59c7ae836af02cb749f60b3005e2c9f9b02208580aa4c665f799f8e526f7836eae02333c404a839cf64b1d
-
SSDEEP
24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Q8kiu5TM:acallSllG4ZM7Q8MK
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1796 3008 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1796 3008 90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe 28 PID 3008 wrote to memory of 1796 3008 90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe 28 PID 3008 wrote to memory of 1796 3008 90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe 28 PID 3008 wrote to memory of 1796 3008 90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe"C:\Users\Admin\AppData\Local\Temp\90b4308c60389dcdd4d1643a3498ba83edfb419e90085be12ad9c704bd727692.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 2202⤵
- Program crash
PID:1796
-