77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac | Triage

Analysis

max time kernel
31s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:24

Sharing

Report Analysis Logs

General

Target

77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac.exe
Size

1024B
MD5

6f24bd0119b7fec178474d5ab3e92cf7
SHA1

b7a2b33438bea1c3304aacdc2ec6d147fcb66558
SHA256

77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac
SHA512

2e87ec529c3e2697c5fd7eba0b8af30c9ad2d9e3cedbd897e83ee470c95ce43b625a2c3f1a88221eb7e94a2d71906a0c875be4ebd7a1b217dde4c87214fb28ac

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1000	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1696	1000	77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac.exe	27
PID 1000 wrote to memory of 1696	1000	77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac.exe	27
PID 1000 wrote to memory of 1696	1000	77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac.exe	27
PID 1000 wrote to memory of 1696	1000	77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac.exe	27

C:\Users\Admin\AppData\Local\Temp\77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac.exe
"C:\Users\Admin\AppData\Local\Temp\77e27147428c89c35cdb77439ccf3d6cc2b3fef59770f505ed3bdd57678841ac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 88
  2⤵
  - Program crash
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download