3969f33f31e2dd36fe9fa0cd1be3fea15af439de17b58d51f1bd80281afa8c4d | Triage

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

time.exe
Size

55KB
MD5

a71db9ee92bf06db1b7199b215ac2f8c
SHA1

df178fa3cd37c40e6bf345c0f1a18f12d3996751
SHA256

91ba9984c49f4485b0c2f87710b567e2026d15c3b6198cca50139d65f4ad6910
SHA512

44d79c3cb64c97714ba27d96aac168d1da261b6f83d48bc892b85ac2d3601ed84bc1b29d9c6e61410625e69af9ce25aa25f56d4730b65297af6491995cdc664a
SSDEEP

768:HbG4E8k5UcjOHJgxwPL95mpd8Ni5d60BLQsLlElhAg6nIE:KpycKHJXPLrNi5hNXLlSyg6nv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1644	1884	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1644	1884	time.exe	28
PID 1884 wrote to memory of 1644	1884	time.exe	28
PID 1884 wrote to memory of 1644	1884	time.exe	28

C:\Users\Admin\AppData\Local\Temp\time.exe
"C:\Users\Admin\AppData\Local\Temp\time.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1884 -s 92
  2⤵
  - Program crash
  PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads