597e90cad10af3bd4de583ac05b15e5697e0a57b7853fb4fca7fc8a0f7acc24d | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 10:14

Sharing

Report Analysis Logs

General

Target

1835DIR231029551-CRE001.exe
Size

37KB
MD5

3b28693a81f4b8e8bc34a5f3c163a11d
SHA1

48e78c0bd2083959c284224107e83d8d7dbd4edd
SHA256

597e90cad10af3bd4de583ac05b15e5697e0a57b7853fb4fca7fc8a0f7acc24d
SHA512

22d9c4e46e76fcd80aca7d3e2a407498ef1116f5eea00b48454f5f3d295fe24621d1243b5659a6557a75c93d315b6ff80bda1729f3bbadec7c83986c6c90835f
SSDEEP

768:ievZNsOyQ1TxGK+RDYRXsYgHa6t+S2Uqt5RYVMgE4O4v:vNsOv1T4K+RDKXS6++SHqtfYC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	1120	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1064	1120	1835DIR231029551-CRE001.exe	26
PID 1120 wrote to memory of 1064	1120	1835DIR231029551-CRE001.exe	26
PID 1120 wrote to memory of 1064	1120	1835DIR231029551-CRE001.exe	26

C:\Users\Admin\AppData\Local\Temp\1835DIR231029551-CRE001.exe
"C:\Users\Admin\AppData\Local\Temp\1835DIR231029551-CRE001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1120 -s 740
  2⤵
  - Program crash
  PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-54-0x0000000001050000-0x000000000105E000-memory.dmp

Filesize
56KB

Download
memory/1120-55-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download