Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2023, 10:35

General

  • Target

    1060/d71d4f7a18e93069f0ad7c6631f49e122710fd4c66e4e91aa8c7c03dd4bc0d2a.exe

  • Size

    13KB

  • MD5

    002ece8b4fed339417ec90651c2ffd97

  • SHA1

    5aeaffaa1e85c990b9a9949fa116e3f5fd32be7c

  • SHA256

    d71d4f7a18e93069f0ad7c6631f49e122710fd4c66e4e91aa8c7c03dd4bc0d2a

  • SHA512

    81c909c6dd349498bed3c1dba045741a280486ad5d6f643dbab0bb2693fe0f9f59932a1979d79083757a72032665c905875cd3ef0485e0e5a9cdbf9ecb619d5f

  • SSDEEP

    192:g0A8xD9so8ZJtRgNJP/fCT6JI3a/95yNSSo0PKG22N6Zx2BpyYjkZ:gpaRso8Z/RgNpnCWJmaeNDkGrmcI

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1060\d71d4f7a18e93069f0ad7c6631f49e122710fd4c66e4e91aa8c7c03dd4bc0d2a.exe
    "C:\Users\Admin\AppData\Local\Temp\1060\d71d4f7a18e93069f0ad7c6631f49e122710fd4c66e4e91aa8c7c03dd4bc0d2a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 548
      2⤵
      • Program crash
      PID:1732

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1976-54-0x00000000000A0000-0x00000000000AA000-memory.dmp

          Filesize

          40KB