Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-08-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe
Resource
win10v2004-20240802-en
General
-
Target
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe
-
Size
331KB
-
MD5
3a0a8189bb8910131bd13c098a1de18b
-
SHA1
600ff8878e9782ff7d3df847b379eca20d3e3bdd
-
SHA256
14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5
-
SHA512
7c55c20d70f08b0c57390fc1decf1d26573c7e04738f1187e2ab3b8ecb0e3aebc06072f88724735828e114cad6592346c0c6b3a8db90c0b5765571fd5beefb6f
-
SSDEEP
6144:o2x6R9b8D6InoSbfVmEtpMMlRMH9O1BNI:o46R9b87noWYapMMlRMo7I
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1384 1716 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 31 PID 1716 wrote to memory of 1384 1716 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 31 PID 1716 wrote to memory of 1384 1716 14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe"C:\Users\Admin\AppData\Local\Temp\14013550a58552ac118e82a83986704af2ff16e7ad74e1ff064cb20e288606b5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1716 -s 322⤵PID:1384
-