772308b9e65e5533176a0b3575bd922d7612209479652ba78849f29bf1d8f30d

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/05/2023, 10:45

Target
b64eecee73322131059674c5e895cd73.exe
Size 40KB
Sample230503-mtds2aed25
SHA256 772308b9e65e5533176a0b3575bd922d7612209479652ba78849f29bf1d8f30d
MD5 b64eecee73322131059674c5e895cd73
SHA1 11c5a9345556cfd77fcf8a29d83f6d527a469ade
SHA512 1eacfd10e3cf2899491b31592474d554025cc64d4c89a86bbddf1ba8e4602ed91d92ab781b5b7864ef51520e93db7c2c6b454d6d24663361aa02ad4c39a234d1
SSDEEP 768:xJLdVpkvgLW3j/ctWc6JDZKX2pXAMLkHfUkTbZIK+c3uTI34thUsj+ki:77SvgCT/zc6J02qVbfP3uTI34tg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1476	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1700	1476	b64eecee73322131059674c5e895cd73.exe	28
PID 1476 wrote to memory of 1700	1476	b64eecee73322131059674c5e895cd73.exe	28
PID 1476 wrote to memory of 1700	1476	b64eecee73322131059674c5e895cd73.exe	28
PID 1476 wrote to memory of 1700	1476	b64eecee73322131059674c5e895cd73.exe	28

C:\Users\Admin\AppData\Local\Temp\b64eecee73322131059674c5e895cd73.exe
"C:\Users\Admin\AppData\Local\Temp\b64eecee73322131059674c5e895cd73.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 468
  2⤵
  - Program crash
  PID:1700

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact