ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4 | Triage

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 02:45

Sharing

Report Analysis Logs

General

Target

ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4.exe
Size

556KB
MD5

73342bdc5cd080f1c7ff67b114c22ed2
SHA1

a614eb57cea7d07a0eca397c25be2e0a81c88ecb
SHA256

ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4
SHA512

93a4a88a2b981cae22e17024c91dade065567ca250f1ca527d92c05011230ad3929b86ea40dd8e839e8939a8d9a21bd8c7f380f54f87adae1a6b0288c27dc21b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	2024	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2000	2024	ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4.exe	27
PID 2024 wrote to memory of 2000	2024	ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4.exe	27
PID 2024 wrote to memory of 2000	2024	ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4.exe	27
PID 2024 wrote to memory of 2000	2024	ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4.exe	27

C:\Users\Admin\AppData\Local\Temp\ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4.exe
"C:\Users\Admin\AppData\Local\Temp\ba0dbbd3b2f7b9194b45ff3e724b6408578b2ca2c3715962d31a0e361e4905b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 156
  2⤵
  - Program crash
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-54-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download