Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07-07-2024 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e9a5e95a13113637d5a8d0a8c20c6c0N.exe
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3e9a5e95a13113637d5a8d0a8c20c6c0N.exe
Resource
win10v2004-20240704-en
10 signatures
150 seconds
General
-
Target
3e9a5e95a13113637d5a8d0a8c20c6c0N.exe
-
Size
329KB
-
MD5
3e9a5e95a13113637d5a8d0a8c20c6c0
-
SHA1
6c5e683cca129d54c3103901907309da7ee38947
-
SHA256
9a5843b931ddf8b07ed981f41e2fd588e6d408540275cd1a7110efedfe2ef16e
-
SHA512
a5977d267b1d57bbda391b3f3a8aab769b3f28d30478ec6ff7c0c70a631542e4b2b9722ae676b1e49c88f7e35e0c26956835a644ece67e026beffaac7865f9f8
-
SSDEEP
6144:3InjA4dI+uVBK7QxWrYlY6nXaQ57zPDT8gRdjMrZ02D4d2wDsUlCyh:3CuBK7Q0S5fPP8gRNmZzF1U4yh
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 236 2120 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 236 2120 3e9a5e95a13113637d5a8d0a8c20c6c0N.exe 31 PID 2120 wrote to memory of 236 2120 3e9a5e95a13113637d5a8d0a8c20c6c0N.exe 31 PID 2120 wrote to memory of 236 2120 3e9a5e95a13113637d5a8d0a8c20c6c0N.exe 31 PID 2120 wrote to memory of 236 2120 3e9a5e95a13113637d5a8d0a8c20c6c0N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e9a5e95a13113637d5a8d0a8c20c6c0N.exe"C:\Users\Admin\AppData\Local\Temp\3e9a5e95a13113637d5a8d0a8c20c6c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 962⤵
- Program crash
PID:236
-