a0ea1a7a87990ca8915015981e5fea45fc7b17e6b2096a7d3da1170ae805d742 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-06-2023 13:08

Sharing

Report Analysis Logs

General

Target

b7ba1c037de6801f69a5a68d1bf5e7bb.exe
Size

29KB
MD5

b7ba1c037de6801f69a5a68d1bf5e7bb
SHA1

31abd270a973fdad798cd15826b3c7d0955d2451
SHA256

a0ea1a7a87990ca8915015981e5fea45fc7b17e6b2096a7d3da1170ae805d742
SHA512

e77f1f291797ecf1c4514bd7ea04bbf26ddb508d62b0916380b556db5d252c4887f4afeb279da724d68e6fabd927e24f98d99d70524f63ea3e6cfaef9048c8fe
SSDEEP

768:nj7ryNDNVLHuvP4G6wej9FUENm4buMvND4l3QoE6hJK:j7eNDNVLHSL4buMNk3QW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	1636	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1060	1636	b7ba1c037de6801f69a5a68d1bf5e7bb.exe	27
PID 1636 wrote to memory of 1060	1636	b7ba1c037de6801f69a5a68d1bf5e7bb.exe	27
PID 1636 wrote to memory of 1060	1636	b7ba1c037de6801f69a5a68d1bf5e7bb.exe	27

C:\Users\Admin\AppData\Local\Temp\b7ba1c037de6801f69a5a68d1bf5e7bb.exe
"C:\Users\Admin\AppData\Local\Temp\b7ba1c037de6801f69a5a68d1bf5e7bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1636 -s 500
  2⤵
  - Program crash
  PID:1060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-54-0x0000000001370000-0x000000000137E000-memory.dmp

Filesize
56KB

Download