384cc542f57b3ac91d5dcecbe38cad92e19f683266b4d44e1b81b73f458489c7 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 18:02

Sharing

Report Analysis Logs

General

Target

WmsApp.exe
Size

965KB
MD5

8aa0605a9f4521de6b6c8c434d673fdf
SHA1

c3d64cbf399616c91c32e10172acf2ea927bc3c8
SHA256

384cc542f57b3ac91d5dcecbe38cad92e19f683266b4d44e1b81b73f458489c7
SHA512

38f863ad39de0fbbbeed5d50ee8aadf2f056f348f3a4b5ed849a5d5b19b8a9ce084a4076c6d1519251f8e6524ff5c0ee93817b66fbc244cdb0e734f7599bc2b6
SSDEEP

24576:6AYaZ/8pXGsiNc0/FJEydpt4StccnWMHZWCpup:HYaZ/8pXGsD0/FJEydpmSt3n5k

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1296	1352	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1296	1352	WmsApp.exe	28
PID 1352 wrote to memory of 1296	1352	WmsApp.exe	28
PID 1352 wrote to memory of 1296	1352	WmsApp.exe	28

C:\Users\Admin\AppData\Local\Temp\WmsApp.exe
"C:\Users\Admin\AppData\Local\Temp\WmsApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1352 -s 532
  2⤵
  - Program crash
  PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-54-0x0000000000E70000-0x0000000000F68000-memory.dmp

Filesize
992KB

Download