7646bfbcd1ae44d8c5f2fc33a75df0af4119d5d55d6cbc4b664f536e91044e51 | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

INQUIRY 2029383736272.exe
Size

558KB
MD5

18706445b9ad11d66100a9b59435afe5
SHA1

e1c29662af823b2613b05c0979af6065f9c6dd78
SHA256

7646bfbcd1ae44d8c5f2fc33a75df0af4119d5d55d6cbc4b664f536e91044e51
SHA512

03db7e67092818bfcd8003044fabe09f105feda0cbcbd72dd08392cca34931d7fd2708c85d0e194151f7f2a5d43214761e1e059fda9fb3ecd1caa27731a898eb
SSDEEP

12288:zvX8v836M180xFG2gOvAPS9lzZcRYgONY:j8v83ogY2glP4hZng

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	1064	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1924	1064	INQUIRY 2029383736272.exe	26
PID 1064 wrote to memory of 1924	1064	INQUIRY 2029383736272.exe	26
PID 1064 wrote to memory of 1924	1064	INQUIRY 2029383736272.exe	26
PID 1064 wrote to memory of 1924	1064	INQUIRY 2029383736272.exe	26

C:\Users\Admin\AppData\Local\Temp\INQUIRY 2029383736272.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY 2029383736272.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 660
  2⤵
  - Program crash
  PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-54-0x00000000008E0000-0x0000000000970000-memory.dmp

Filesize
576KB

Download
memory/1064-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1064-56-0x0000000001EC0000-0x0000000001F42000-memory.dmp

Filesize
520KB

Download