Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 11:19
Behavioral task
behavioral1
Sample
29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe
Resource
win10v2004-20241007-en
General
-
Target
29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe
-
Size
653KB
-
MD5
feea6d31061ca6e6d6f9ceb0c0d6e220
-
SHA1
3b14af425cc5208ee5a32f321f8eeccaa6714a79
-
SHA256
29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16
-
SHA512
6950f7d06954e8e77d4f91ae8840137bc7ea645f1bb2892558a1b3a88f2aaa81625d833c55cbbf526d1d05ed9b6386b6b75aaeab16ccf23a065848ca3dd931db
-
SSDEEP
12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+O:j7vmp8Rz1GJR8AB+Is9yvr7/jkH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1832-0-0x000000013F440000-0x000000013F862000-memory.dmp upx behavioral1/memory/1832-3-0x000000013F440000-0x000000013F862000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1268 1832 29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe 31 PID 1832 wrote to memory of 1268 1832 29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe 31 PID 1832 wrote to memory of 1268 1832 29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe"C:\Users\Admin\AppData\Local\Temp\29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1832 -s 842⤵PID:1268
-