acb4129997c2a5659b93d4c5d2ca1634b4ad0479d6bb2c326174a7d2fafd316c | Triage

Analysis

max time kernel
101s
max time network
30s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 12:59

Sharing

Report Analysis Logs

General

Target

4db89183f3802bexeexeexeex.exe
Size

520KB
MD5

4db89183f3802bd31da76972b7adfe83
SHA1

3dce54de568b6b8c24e666769e9f3210dde46836
SHA256

acb4129997c2a5659b93d4c5d2ca1634b4ad0479d6bb2c326174a7d2fafd316c
SHA512

55d3d3da8a293da4e68705285f4f7b25f23e5eab7b8e234273d7c5d55aec5edd4f65efc8dc20a03b47f2c42be574ea2eaf65fd61530cab3f3972fd7571403113
SSDEEP

12288:+XZ5ZmDsot+t8dTj6SNtZ4jbYzQPsbTFB9Q6VPNZ:+XZKDsHt8R3tZwUzQPsbTFMON

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	2968	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2896	2968	4db89183f3802bexeexeexeex.exe	27
PID 2968 wrote to memory of 2896	2968	4db89183f3802bexeexeexeex.exe	27
PID 2968 wrote to memory of 2896	2968	4db89183f3802bexeexeexeex.exe	27
PID 2968 wrote to memory of 2896	2968	4db89183f3802bexeexeexeex.exe	27

C:\Users\Admin\AppData\Local\Temp\4db89183f3802bexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\4db89183f3802bexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 132
  2⤵
  - Program crash
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads