c0f964f8f96bcba4be2939d74fca291d537801737cdde729b9cc9c3aca2a16b7 | Triage

Analysis

max time kernel
44s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-09-2022 06:15

Sharing

Report Analysis Logs

General

Target

file.exe
Size

664KB
MD5

6435f7fe410afb11ad58885eeb93b23c
SHA1

60abc8c92aab1b431183db265575f074ae863378
SHA256

c0f964f8f96bcba4be2939d74fca291d537801737cdde729b9cc9c3aca2a16b7
SHA512

379b0bae9b222b6c0ef971e7659fe1a63f678730de7bf84fb4c30b8271df88b575f6931f73f10d990b05cbfc21feb3fb4926c6628394d7f1829accf8b104787d
SSDEEP

6144:1BYbaoykQEKFhXGonXVfmBFm7g0CzrPdhylku3fOzcVBXJMiehO:1ibJbQEKFhXBnVmmg0Cdhyu0JKE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1508	1084	WerFault.exe	26

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1652	1084	file.exe	27
PID 1084 wrote to memory of 1652	1084	file.exe	27
PID 1084 wrote to memory of 1652	1084	file.exe	27
PID 1084 wrote to memory of 1652	1084	file.exe	27
PID 1084 wrote to memory of 1508	1084	file.exe	28
PID 1084 wrote to memory of 1508	1084	file.exe	28
PID 1084 wrote to memory of 1508	1084	file.exe	28
PID 1084 wrote to memory of 1508	1084	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 52
  2⤵
  - Program crash
  PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-54-0x0000000000000000-mapping.dmp

Download