f227efd232abea1cf9a956c979a350bfe0bd6d09a021a7056073a4d73dba231f | Triage™

Analysis

max time kernel
117s
max time network
57s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
06/08/2022, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5eab3baf61e35998a0213ea8b0e2658.exe
Size 916KB
Sample220806-jspblaccgp
SHA256 f227efd232abea1cf9a956c979a350bfe0bd6d09a021a7056073a4d73dba231f
MD5 c5eab3baf61e35998a0213ea8b0e2658
SHA1 d4e134055581368e498fb3ac97d6d1c2f9d4d2bb
SHA512 a361e4a6021d035382eb98fc1377d507962913767ea9e6c61f45a81ebc6ed576713951af8a0676d668146bc39937cb450340ccd78abc40ef2ecb0966b6d0e349
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1308	788	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1308	788	c5eab3baf61e35998a0213ea8b0e2658.exe	29
PID 788 wrote to memory of 1308	788	c5eab3baf61e35998a0213ea8b0e2658.exe	29
PID 788 wrote to memory of 1308	788	c5eab3baf61e35998a0213ea8b0e2658.exe	29
PID 788 wrote to memory of 1308	788	c5eab3baf61e35998a0213ea8b0e2658.exe	29

C:\Users\Admin\AppData\Local\Temp\c5eab3baf61e35998a0213ea8b0e2658.exe
"C:\Users\Admin\AppData\Local\Temp\c5eab3baf61e35998a0213ea8b0e2658.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 780
  2⤵
  - Program crash
  PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-54-0x0000000076601000-0x0000000076603000-memory.dmp

Download