Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 13:22
Behavioral task
behavioral1
Sample
4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe
Resource
win10v2004-20240611-en
General
-
Target
4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe
-
Size
426KB
-
MD5
ba07b8206eb155c5f8dfe3cff5750861
-
SHA1
6e05876a4ab629879726f77c05c6ee8505262c49
-
SHA256
4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793
-
SHA512
e907e059ad6d6df06176badf98336d5da6f5e967dd4b25fe631b5832a17cf88e460565e3698f5a35fac5c3c20991b599b029732775509853f8f18929adce2073
-
SSDEEP
6144:8Z5f30291xuMHlpw9wrvwewMdBtbIbd5xv6P/6CuCNJ0hOY9:8nk291kMHlpw6r4eL3IbxvoyClwz9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exedescription pid process target process PID 3064 wrote to memory of 2084 3064 4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe WerFault.exe PID 3064 wrote to memory of 2084 3064 4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe WerFault.exe PID 3064 wrote to memory of 2084 3064 4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe"C:\Users\Admin\AppData\Local\Temp\4acd4645740cff555bd5c7fdd8167a1ded999d4d5a0a6ad84fc5d998faa5c793.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3064 -s 762⤵PID:2084