289e5b004b02ef44954a29f80d6656c69874c260ef249acf5dac3a3c3e3f81c7 | Triage

Analysis

max time kernel
72s
max time network
76s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 12:13

Sharing

Report Analysis Logs

General

Target

46cf2e3ba96a11exeexeexeex.exe
Size

208KB
MD5

46cf2e3ba96a1139ea7d94b43a011ac8
SHA1

fadee3aae39dcbda03281661a3adae48a7276bf8
SHA256

289e5b004b02ef44954a29f80d6656c69874c260ef249acf5dac3a3c3e3f81c7
SHA512

ce7488c48c3e66792bda299e6b4478d9699b20fcd79deb4c66ff030b7355e7dd83f171ec47e72418f15a9d36e586e0952e1cc87741504fbc457dc64369369964
SSDEEP

3072:ZVJKJPd9PZBQIdmx3dtO0cPlDJBFcLlYu63+ynIz70:ZVJKxZBQId1rPpTFcSu0+yn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2428	2172	46cf2e3ba96a11exeexeexeex.exe	28
PID 2172 wrote to memory of 2428	2172	46cf2e3ba96a11exeexeexeex.exe	28
PID 2172 wrote to memory of 2428	2172	46cf2e3ba96a11exeexeexeex.exe	28
PID 2172 wrote to memory of 2428	2172	46cf2e3ba96a11exeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\46cf2e3ba96a11exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\46cf2e3ba96a11exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 36
  2⤵
  - Program crash
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-54-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download