Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08-06-2024 18:48
Behavioral task
behavioral1
Sample
0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
Resource
win10v2004-20240508-en
General
-
Target
0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
-
Size
2.9MB
-
MD5
32dfd38036d85d1b0de44e1c6b61cdff
-
SHA1
d29f730001f6f65b6dfd75682893eef1cbc41b95
-
SHA256
0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a
-
SHA512
a4ce001e52022f5aca59af85bd489f141fdb9973214dcc36a86a1704e5ee0ab574d18f4b11c9646c83266c83cd22a16663b671e295c2bf718313ed51652f7da3
-
SSDEEP
49152:M5JnNd1X1OFPHZXgtN5tI5to9s8Ztl4x/xClHVkmDW/CiC+Z+W:Enh1OFPlTeyCHVzDW/CbS
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2376 384 WerFault.exe 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exepid process 384 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe 384 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exedescription pid process target process PID 384 wrote to memory of 2376 384 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe WerFault.exe PID 384 wrote to memory of 2376 384 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe WerFault.exe PID 384 wrote to memory of 2376 384 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe WerFault.exe PID 384 wrote to memory of 2376 384 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe"C:\Users\Admin\AppData\Local\Temp\0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 2682⤵
- Program crash