eeaa4c74a2acbd170bdc7a517511fe84b809349481442e78026a74b87ab72220 | Triage

Analysis

max time kernel
26s
max time network
30s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 15:08

Sharing

Report Analysis Logs

General

Target

347af84d4ddee1exeexeexeex.exe
Size

2.1MB
MD5

347af84d4ddee15dcd63990d9a28dd75
SHA1

c0ce6ab84ce12c1280a475a3297072651ab8e3fc
SHA256

eeaa4c74a2acbd170bdc7a517511fe84b809349481442e78026a74b87ab72220
SHA512

b57bed515ca68437bd5503601a26230df7864eb1909a3989203028ef93dd335bcee08418b9b761ab122466019693c1a41bb1842c0513b245269fa715c24746b9
SSDEEP

49152:ORih8F85hBRgxhUH+wLHT1g2QrQPkX34vsh3ANkTTl:r8F85hBR9ewAQPkYM3AM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	2380	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2068	2380	347af84d4ddee1exeexeexeex.exe	28
PID 2380 wrote to memory of 2068	2380	347af84d4ddee1exeexeexeex.exe	28
PID 2380 wrote to memory of 2068	2380	347af84d4ddee1exeexeexeex.exe	28
PID 2380 wrote to memory of 2068	2380	347af84d4ddee1exeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\347af84d4ddee1exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\347af84d4ddee1exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 116
  2⤵
  - Program crash
  PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads