Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-10-2024 01:29
Static task
static1
Behavioral task
behavioral1
Sample
8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe
Resource
win10v2004-20241007-en
General
-
Target
8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe
-
Size
2.6MB
-
MD5
0c01cfc0685211b3c655c7a9526f1849
-
SHA1
864d23804b6e3c98efd1b56863a484b505ddf40b
-
SHA256
8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6
-
SHA512
6024a41f371d77a82608c0e8ff314853404a50decb77838ace61c43a72ef954f4a227849b85e2aa3ef0749120e8361f13145006652596fb22b2f972bf7585719
-
SSDEEP
49152:EZPf0tL9d77T+WScpPNBqB0+i8jS9fQzm/kv49hISc1HeW6YS3jLqFtJc:TVScpPN3D/8Sc1HeW6YSad
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2272 1684 8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe 30 PID 1684 wrote to memory of 2272 1684 8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe 30 PID 1684 wrote to memory of 2272 1684 8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe"C:\Users\Admin\AppData\Local\Temp\8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1684 -s 282⤵PID:2272
-