b9ce22d86ba1fd0268708a85e302d079f4aea92d36334b385aac28465cf67e9d | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 05:18

Sharing

Report Analysis Logs

General

Target

INVOICE AZ340098.exe
Size

96KB
MD5

6cb19652cca7715b5bfdbab9dd37b5c9
SHA1

974ddadb8e316cb800cf8cfde95f22a17ea1fd52
SHA256

b9ce22d86ba1fd0268708a85e302d079f4aea92d36334b385aac28465cf67e9d
SHA512

83d395c6d457f40341ade28db7b1ed9bbb19e92d246a4a5918ab9c268cdcc5d62cd1305117fa9c2a0d4177119a280aeb775d76e603793a01e1667f4533ae0347
SSDEEP

768:O++rN0JFuOPIkzhNM75NbcVfup+btYAJHa4H:OBN04kzjUcVfupotYyTH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1428	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2024	1428	INVOICE AZ340098.exe	27
PID 1428 wrote to memory of 2024	1428	INVOICE AZ340098.exe	27
PID 1428 wrote to memory of 2024	1428	INVOICE AZ340098.exe	27

C:\Users\Admin\AppData\Local\Temp\INVOICE AZ340098.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE AZ340098.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1428 -s 700
  2⤵
  - Program crash
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-54-0x0000000000F40000-0x0000000000F5C000-memory.dmp

Filesize
112KB

Download