f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/02/2023, 14:43

Sharing

Report Analysis Logs

General

Target

pre alert notice.exe
Size

64KB
MD5

8595f4d3b0f77f0b34b575fd4e8d89e3
SHA1

0f14cc20a764a431c9522585037170e55dfe0d64
SHA256

f5231414600e6239f0928f88a018e349d0856aa14b133905ab8fa05b6288d225
SHA512

d5666b6053405884a4ee8ea886d8c1e8620df39e1fdf3a5e789fd7882bab94bc96f5d696c8be8452de39186b974c7435b553ee736f35f59ab622a1cffabad488
SSDEEP

768:M0OGy94wjvuLm0DNOD9I840O/KeSHs40LO6dusn04eZ:JOd94wjvuL9a9I84us40ymuL3Z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	1384	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2000	1384	pre alert notice.exe	28
PID 1384 wrote to memory of 2000	1384	pre alert notice.exe	28
PID 1384 wrote to memory of 2000	1384	pre alert notice.exe	28

C:\Users\Admin\AppData\Local\Temp\pre alert notice.exe
"C:\Users\Admin\AppData\Local\Temp\pre alert notice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1384 -s 732
  2⤵
  - Program crash
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-54-0x0000000000E40000-0x0000000000E54000-memory.dmp

Filesize
80KB

Download