f5d3df7ed5a6a84b14c3200752e6a43b3d8f23ab08fb0c1f7f7e192bb48cb206 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 10:39

Sharing

Report Analysis Logs

General

Target

1wwyaeeCYc.exe
Size

96KB
MD5

749fdef07e576ac40e42568780bd26bd
SHA1

93d0094038126ec31a5f0a9251318cdfb163cade
SHA256

a58ee92cdb05c92453c009c0792676ce815af1298cbbe9f36407d4933b8b942e
SHA512

d7e97331ce90dffa4d3da967e35c5b03b8454e220d2104f54c0f476ae73d5de78917e8cb0fcdd2df1b251e584cab38fa5a339195e8dfc845201f8d19e5a2ffe2
SSDEEP

1536:H0l3SSJshJixmFLZbIUfyVAEfUtweBXDMKrxWGHXKBJNfGtLF9pZO:9dhJVZbIUqVAbFDM0c7JNfAJ9pZO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	1304	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1052	1304	1wwyaeeCYc.exe	27
PID 1304 wrote to memory of 1052	1304	1wwyaeeCYc.exe	27
PID 1304 wrote to memory of 1052	1304	1wwyaeeCYc.exe	27

C:\Users\Admin\AppData\Local\Temp\1wwyaeeCYc.exe
"C:\Users\Admin\AppData\Local\Temp\1wwyaeeCYc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1304 -s 716
  2⤵
  - Program crash
  PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-54-0x00000000009E0000-0x00000000009FC000-memory.dmp

Filesize
112KB

Download
memory/1304-55-0x000000001B360000-0x000000001B3E0000-memory.dmp

Filesize
512KB

Download
memory/1304-56-0x000000001B360000-0x000000001B3E0000-memory.dmp

Filesize
512KB

Download