12e7c12e40f2da3054e91ae03f1130defcaccf82247c241ffd07716463f9814e | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Hanson.Product.Erp7.Hrm7.GRP.exe
Size

7KB
MD5

1dd1489c65a00c3bd5f686c98444f080
SHA1

bb71be6ad338e904b1d334f8c21f41bf3e4c5f56
SHA256

12e7c12e40f2da3054e91ae03f1130defcaccf82247c241ffd07716463f9814e
SHA512

bca27895c1d3c379716ef8fd2b7ea123144cc7034ca8a215b3afd0777b5b9fc84ed12c407ac6ebc5df4a555a4e1bef129f8b05d12f8a39b23162f4e8b2865f55
SSDEEP

96:vdrqgGOyGnie4J9UhfILNL1eh+2A1E1pXiY2Ukof9dI9zNt:9vGOyJaxILTt1EHiDQO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1212	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1788	1212	Hanson.Product.Erp7.Hrm7.GRP.exe	28
PID 1212 wrote to memory of 1788	1212	Hanson.Product.Erp7.Hrm7.GRP.exe	28
PID 1212 wrote to memory of 1788	1212	Hanson.Product.Erp7.Hrm7.GRP.exe	28
PID 1212 wrote to memory of 1788	1212	Hanson.Product.Erp7.Hrm7.GRP.exe	28

C:\Users\Admin\AppData\Local\Temp\Hanson.Product.Erp7.Hrm7.GRP.exe
"C:\Users\Admin\AppData\Local\Temp\Hanson.Product.Erp7.Hrm7.GRP.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 552
  2⤵
  - Program crash
  PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-54-0x0000000000F60000-0x0000000000F68000-memory.dmp

Filesize
32KB

Download