02eabeb78049c62c0da289e289d9ffff6b4b4a10cc150f08563de5d103cccf10 | Triage

Analysis

max time kernel
31s
max time network
35s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 20:00

Sharing

Report Analysis Logs

General

Target

1e1cd0a4c07f32exeexeexeex.exe
Size

971KB
MD5

1e1cd0a4c07f32557aa7e587b5e8bdc2
SHA1

0381bc3bdfa7cf5eaacc9c98728f1652ffe872c1
SHA256

02eabeb78049c62c0da289e289d9ffff6b4b4a10cc150f08563de5d103cccf10
SHA512

7219443817e2a3977e164939453c4c02180c4d33cb8ed98bcf0a023df52ee1a6b026759bde6b28a8aa88c2839ddcdde817174146ed536df6922621440de0a12f
SSDEEP

24576:KGmj8GFiYBcNDDot26QkBqbVJSx4SkN8xnHa+v+:KGmg/lDtx/G4Sb+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	2324	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1104	2324	1e1cd0a4c07f32exeexeexeex.exe	29
PID 2324 wrote to memory of 1104	2324	1e1cd0a4c07f32exeexeexeex.exe	29
PID 2324 wrote to memory of 1104	2324	1e1cd0a4c07f32exeexeexeex.exe	29
PID 2324 wrote to memory of 1104	2324	1e1cd0a4c07f32exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\1e1cd0a4c07f32exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\1e1cd0a4c07f32exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 36
  2⤵
  - Program crash
  PID:1104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-54-0x0000000000150000-0x0000000000251000-memory.dmp

Filesize
1.0MB

Download
memory/2324-55-0x0000000000150000-0x0000000000251000-memory.dmp

Filesize
1.0MB

Download
memory/2324-56-0x0000000000150000-0x0000000000251000-memory.dmp

Filesize
1.0MB

Download