27a37a8a1e96bf4cb100cb1c4af9115b6ce8dfac1abc85037f7e3ac32834ba26 | Triage

Analysis

max time kernel
67s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 19:06

Sharing

Report Analysis Logs

General

Target

e30000.exe
Size

364KB
MD5

a25ec9f110118e2005efb708122a966e
SHA1

cf44fd846eb0507fed3cc52a9e778e9aa681b794
SHA256

27a37a8a1e96bf4cb100cb1c4af9115b6ce8dfac1abc85037f7e3ac32834ba26
SHA512

fc6e69c48517631baf72d22a64040273035998edb50e522e41afaad4c6967fcde9e1cf897643d38a516f1f84e7fc433a4792f3df991bb340b605cc8ef0b6ceec
SSDEEP

6144:FoJbCQpRFj/ThaVvBUT2FfIuZml7p0zeaUpT:FH0FU8wfIuZmlNEe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1192	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1192	2040	e30000.exe	28
PID 2040 wrote to memory of 1192	2040	e30000.exe	28
PID 2040 wrote to memory of 1192	2040	e30000.exe	28
PID 2040 wrote to memory of 1192	2040	e30000.exe	28

C:\Users\Admin\AppData\Local\Temp\e30000.exe
"C:\Users\Admin\AppData\Local\Temp\e30000.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 124
  2⤵
  - Program crash
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download