2fd6984975fe63d3299e1aab2220d15445ea5509e7ae9f308828b01db63b4996 | Triage

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/05/2023, 14:38

Sharing

Report Analysis Logs

General

Target

Microsoft Exchange Services Health.exe
Size

30KB
MD5

4b079c6c0c25d81c65c94f502f4bd148
SHA1

53ae850bdbdead557255e0d0a5a7fc0b6d119c45
SHA256

2fd6984975fe63d3299e1aab2220d15445ea5509e7ae9f308828b01db63b4996
SHA512

955bec03df5b6f2fb8c05aad91d3ca54d2695ec129f355aead5a917a865c3dc977d6299571c73ed029a85bf500684b40c6f65e93b97860e219caa23041c1060f
SSDEEP

768:hEHZnhI0GaRHV/RWM41v1BbpChP1o2gm3Htd:hEHZjetM5LX3v

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1980	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1700	1980	Microsoft Exchange Services Health.exe	28
PID 1980 wrote to memory of 1700	1980	Microsoft Exchange Services Health.exe	28
PID 1980 wrote to memory of 1700	1980	Microsoft Exchange Services Health.exe	28

C:\Users\Admin\AppData\Local\Temp\Microsoft Exchange Services Health.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft Exchange Services Health.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1980 -s 540
  2⤵
  - Program crash
  PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-54-0x0000000000AB0000-0x0000000000ABE000-memory.dmp

Filesize
56KB

Download