8316140f4313a31559ef2b42f974931b18098dc8087372d5e88415e66dc2bdbf | Triage

Analysis

max time kernel
39s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 13:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

912135619e8dc4b1233feec0407ce5f8603a675d.exe
Size

100KB
MD5

3177d9f17b5ee1ce18d7964fdfcba4d6
SHA1

912135619e8dc4b1233feec0407ce5f8603a675d
SHA256

8316140f4313a31559ef2b42f974931b18098dc8087372d5e88415e66dc2bdbf
SHA512

5a3a09e3d8a19574a4f1ea97fc145d4a706cf0e298be1e7624bf40fd920a76b997277589397e6b416d758577ad5962982a40c0119b717f7348e29322b709e207
SSDEEP

3072:ka+pHk5HRwLKaC6MFIYBfPDZsT6H7aw5:kaUq7aRBYBfP++Ww5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	1440	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1336	1440	912135619e8dc4b1233feec0407ce5f8603a675d.exe	28
PID 1440 wrote to memory of 1336	1440	912135619e8dc4b1233feec0407ce5f8603a675d.exe	28
PID 1440 wrote to memory of 1336	1440	912135619e8dc4b1233feec0407ce5f8603a675d.exe	28
PID 1440 wrote to memory of 1336	1440	912135619e8dc4b1233feec0407ce5f8603a675d.exe	28

C:\Users\Admin\AppData\Local\Temp\912135619e8dc4b1233feec0407ce5f8603a675d.exe
"C:\Users\Admin\AppData\Local\Temp\912135619e8dc4b1233feec0407ce5f8603a675d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 88
  2⤵
  - Program crash
  PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download