Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe
Resource
win10v2004-20240508-en
General
-
Target
2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe
-
Size
755KB
-
MD5
ea919de39b4618e0e1f0a4edf18dd856
-
SHA1
2786cbc8daafd63483ef9a1435815a08b3a6448f
-
SHA256
2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1
-
SHA512
f05c2ab39462bba109c4dfb13ee33f0e60bb31fe3d63db9c78b003b6fe5934dc05e00fb60a29ecdd53a257719d775c0a48b8b15ed32555cc2402d34eed43b261
-
SSDEEP
12288:xKCR5leZlNR4uAm+rfofbonJ7kYBx8OGFr6c7V9mbGdn+s7ny46CykR:c+erTGtEuJ7kuqFTt+s7nN
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2264 set thread context of 2464 2264 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2712 2464 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2464 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2464 2264 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 28 PID 2264 wrote to memory of 2464 2264 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 28 PID 2264 wrote to memory of 2464 2264 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 28 PID 2264 wrote to memory of 2464 2264 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 28 PID 2264 wrote to memory of 2464 2264 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 28 PID 2264 wrote to memory of 2464 2264 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 28 PID 2264 wrote to memory of 2464 2264 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 28 PID 2464 wrote to memory of 2712 2464 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 29 PID 2464 wrote to memory of 2712 2464 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 29 PID 2464 wrote to memory of 2712 2464 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 29 PID 2464 wrote to memory of 2712 2464 2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe"C:\Users\Admin\AppData\Local\Temp\2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe"C:\Users\Admin\AppData\Local\Temp\2cfa51f304105aba231c6f6ac26e41e64bc644f06fc529e3f2e22147d40347f1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 363⤵
- Program crash
PID:2712
-
-