573992471eae6fe18a1034c30c43f7f813dd29972f4c0f6744c08465f7922906 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 14:24

Sharing

Report Analysis Logs

General

Target

0145227772693fexeexeexeex.exe
Size

143KB
MD5

0145227772693f325e4feea36013b0ed
SHA1

3b095b870f0d8cc00d55c5c88ef4b269a6969735
SHA256

573992471eae6fe18a1034c30c43f7f813dd29972f4c0f6744c08465f7922906
SHA512

734662c70f2390cec8ae009644dcfe4d7ec6fdbb0c25631f3fb3e6f63058449653e198ccf28e733d107facfb95fa561c5cc2c71d568235e35f30159ebfb3afa7
SSDEEP

3072:o+HcL2ICfJTntqSQRruiMZMqqDL2/Awvdr7Vjp9:hRDtORruiMyqqDL6tvdRp9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
564	3064	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 564	3064	0145227772693fexeexeexeex.exe	29
PID 3064 wrote to memory of 564	3064	0145227772693fexeexeexeex.exe	29
PID 3064 wrote to memory of 564	3064	0145227772693fexeexeexeex.exe	29
PID 3064 wrote to memory of 564	3064	0145227772693fexeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\0145227772693fexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\0145227772693fexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 88
  2⤵
  - Program crash
  PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads