30570f1bc186e7ed9d46ac01aebde9300faf1ee4b6884a004e4e0fd8e2f11d59 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11/01/2023, 08:36

Sharing

Report Analysis Logs

General

Target

MW1.exe
Size

49KB
MD5

a193637649d17718e7a3b69d5eaa608e
SHA1

ab325d5e499fe12c184ccec5537690ab0cba9fd8
SHA256

30570f1bc186e7ed9d46ac01aebde9300faf1ee4b6884a004e4e0fd8e2f11d59
SHA512

fbbb21526c2813b9eb6e6b9be59b38ad8a71269f425793e57c5789a4ad63d6ebe68bdbea790f39a499e584c0bae0256bd4ae80ea34ad9806f918aaaa09d72c2e
SSDEEP

768:h5EEmRla+Ig3yS+oHsiLwrH5qtJDGUl0Uf/gSoxCAZMDO6eg:h8a+eSAi8H0tJD2UfEWJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	856	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1184	856	MW1.exe	29
PID 856 wrote to memory of 1184	856	MW1.exe	29
PID 856 wrote to memory of 1184	856	MW1.exe	29
PID 856 wrote to memory of 1184	856	MW1.exe	29

C:\Users\Admin\AppData\Local\Temp\MW1.exe
"C:\Users\Admin\AppData\Local\Temp\MW1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 104
  2⤵
  - Program crash
  PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads