6d816f68418de557b9c98067ddbe01771d1fa929c02a6d3b369f6ddcb07ad2b1 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/04/2023, 07:17

Sharing

Report Analysis Logs

General

Target

file.exe
Size

1.5MB
MD5

c145368f4a398c1e079452402f19e558
SHA1

bfef72b62570b4998afe15e429d55b026a4c97b6
SHA256

6d816f68418de557b9c98067ddbe01771d1fa929c02a6d3b369f6ddcb07ad2b1
SHA512

48a1da0a96aafdcfae4b40a6391574eed56026237e64c256ba884ed1376371a5c4029fdf1baec601d3b5ea1698b11c3b6f410c0a09127d6cfa6e076d361048e7
SSDEEP

12288:xaWvxinENAuEp9I+PRAxI+Rahx6k2nBhpL0EUqMDxIrH6o7fThewQk4phLteeHrd:xaWvOX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
692	1996	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 692	1996	file.exe	28
PID 1996 wrote to memory of 692	1996	file.exe	28
PID 1996 wrote to memory of 692	1996	file.exe	28
PID 1996 wrote to memory of 692	1996	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 756
  2⤵
  - Program crash
  PID:692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x00000000010B0000-0x000000000122E000-memory.dmp

Filesize
1.5MB

Download
memory/1996-55-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1996-56-0x0000000001020000-0x0000000001060000-memory.dmp

Filesize
256KB

Download
memory/1996-57-0x0000000001020000-0x0000000001060000-memory.dmp

Filesize
256KB

Download