9a09be411301654dd0e482fa0bcad69ad145b15bab704d5812bb53b7667d8066 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-06-2023 19:46

Sharing

Report Analysis Logs

General

Target

Email.exe
Size

76KB
MD5

d75ec856d684123a9c4d41c0419ebd4b
SHA1

499af216f74b40a128894e6a9161fec87caca06c
SHA256

9a09be411301654dd0e482fa0bcad69ad145b15bab704d5812bb53b7667d8066
SHA512

8e5792045dd6b2547f17fca6f404fc669a54df407c6e15afa5546d928c891f63e37df27ed7296f55726725fdf460314dcaa311f73a27e9d1e161361dd0426c00
SSDEEP

1536:YX5zw09HvhzVbYdiHqcFU6o6cvU24rEB8RGkxcbYdkbZQfB7wOkzy:CRz9HZBM6c8RrEB8Tx1x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
936	2004	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 936	2004	Email.exe	28
PID 2004 wrote to memory of 936	2004	Email.exe	28
PID 2004 wrote to memory of 936	2004	Email.exe	28
PID 2004 wrote to memory of 936	2004	Email.exe	28

C:\Users\Admin\AppData\Local\Temp\Email.exe
"C:\Users\Admin\AppData\Local\Temp\Email.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 756
  2⤵
  - Program crash
  PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-54-0x0000000000D50000-0x0000000000D68000-memory.dmp

Filesize
96KB

Download
memory/2004-55-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/2004-56-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/2004-57-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download