1df2abaeb694448136c6b421998e288964ac01ea12cd8d35cf965edf01c78b59 | Triage

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05-07-2023 16:47

Sharing

Report Analysis Logs

General

Target

11a537db173eaaexeexeexeex.exe
Size

971KB
MD5

11a537db173eaa5ace59c341328d0e3b
SHA1

8ee07ffc3fa9ff1a694778b98080736b4857a591
SHA256

1df2abaeb694448136c6b421998e288964ac01ea12cd8d35cf965edf01c78b59
SHA512

4291d50044d8c4ee3828659bacff90b8163396d611faadcbdfb249fc188b5bf48794e1f91e26affa675e2b0f3a52b2c968b9e6e936433e2754d6db66caab78b5
SSDEEP

24576:LGmj8GFiYBcNDDot26QkBqbVJS04SV18xnHtuv+:LGmg/lDtx/D4Sd+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	564	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1172	564	11a537db173eaaexeexeexeex.exe	28
PID 564 wrote to memory of 1172	564	11a537db173eaaexeexeexeex.exe	28
PID 564 wrote to memory of 1172	564	11a537db173eaaexeexeexeex.exe	28
PID 564 wrote to memory of 1172	564	11a537db173eaaexeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\11a537db173eaaexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\11a537db173eaaexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 44
  2⤵
  - Program crash
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-54-0x0000000001360000-0x0000000001461000-memory.dmp

Filesize
1.0MB

Download
memory/564-55-0x0000000001360000-0x0000000001461000-memory.dmp

Filesize
1.0MB

Download
memory/564-56-0x0000000001360000-0x0000000001461000-memory.dmp

Filesize
1.0MB

Download