f0f1a2656f7200dabf3ec469aa2dcea16188be26c8142449734f3d1eeb25ca01 | Triage

Analysis

max time kernel
102s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 20:17

Sharing

Report Analysis Logs

General

Target

57021432e2192aexeexeexeex.exe
Size

520KB
MD5

57021432e2192a3da8161b03b362d246
SHA1

829edb933ea475671f87a3c28dc52e7b9e7bca71
SHA256

f0f1a2656f7200dabf3ec469aa2dcea16188be26c8142449734f3d1eeb25ca01
SHA512

4e58ef818656cfba17c42276e54912712760c647dd1b40d27b9468f74207404c20ee3b68d51cfa397d4230b217217ba02e30be75ba2916b54c3d60ff96a64ad9
SSDEEP

12288:8Eih1G7Vbyx6grJx3BiaEBED1VdHt/k2cnSFTgPNZ:8EiG78xBrfBPWEjdHtk2cnKAN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	852	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2180	852	57021432e2192aexeexeexeex.exe	28
PID 852 wrote to memory of 2180	852	57021432e2192aexeexeexeex.exe	28
PID 852 wrote to memory of 2180	852	57021432e2192aexeexeexeex.exe	28
PID 852 wrote to memory of 2180	852	57021432e2192aexeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\57021432e2192aexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\57021432e2192aexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 132
  2⤵
  - Program crash
  PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads