Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 04:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c72e70f29d3dd8fa148df55e8e6dec43.exe
Resource
win7-20231129-en
2 signatures
150 seconds
General
-
Target
c72e70f29d3dd8fa148df55e8e6dec43.exe
-
Size
1.8MB
-
MD5
c72e70f29d3dd8fa148df55e8e6dec43
-
SHA1
2f182d43528f78d6d847b37b77da9a09a2ed1f0a
-
SHA256
baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b
-
SHA512
d1923e33057413d478daaaaa54bb157762172a58ae03fc36e0c1c6e4d64c0c33d08bff7aec8759f533331215960d739fec2ffea86d18d1d8a70105927a6a5f12
-
SSDEEP
49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2376 824 WerFault.exe c72e70f29d3dd8fa148df55e8e6dec43.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c72e70f29d3dd8fa148df55e8e6dec43.exedescription pid process target process PID 824 wrote to memory of 2376 824 c72e70f29d3dd8fa148df55e8e6dec43.exe WerFault.exe PID 824 wrote to memory of 2376 824 c72e70f29d3dd8fa148df55e8e6dec43.exe WerFault.exe PID 824 wrote to memory of 2376 824 c72e70f29d3dd8fa148df55e8e6dec43.exe WerFault.exe PID 824 wrote to memory of 2376 824 c72e70f29d3dd8fa148df55e8e6dec43.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c72e70f29d3dd8fa148df55e8e6dec43.exe"C:\Users\Admin\AppData\Local\Temp\c72e70f29d3dd8fa148df55e8e6dec43.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 1082⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/824-0-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB