211357a87352d434ee8c47147f9ea377528cbcee475a6cf842cf90599c4f9e51 | Triage

Analysis

max time kernel
74s
max time network
78s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 09:52

Sharing

Report Analysis Logs

General

Target

69f3e68c22b268exeexeexeex.exe
Size

971KB
MD5

69f3e68c22b268dbc36d6dcff6118699
SHA1

171f463c085a30dd00adac7f5df7c08dde720184
SHA256

211357a87352d434ee8c47147f9ea377528cbcee475a6cf842cf90599c4f9e51
SHA512

d5de88dec44d84cb435889b20e5f88eb72a2c199cee3a4b2d258f5f708f34e3250350e9a9125c075d03babe7929e4f3009fb8bcc0b22f8af0b11250ed3dc36ab
SSDEEP

24576:JGmj8GFiYBcNDDot26QkBqbVJS04STH8xnHyev+:JGmg/lDtx/D4SC+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	3052	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 952	3052	69f3e68c22b268exeexeexeex.exe	28
PID 3052 wrote to memory of 952	3052	69f3e68c22b268exeexeexeex.exe	28
PID 3052 wrote to memory of 952	3052	69f3e68c22b268exeexeexeex.exe	28
PID 3052 wrote to memory of 952	3052	69f3e68c22b268exeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\69f3e68c22b268exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\69f3e68c22b268exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 36
  2⤵
  - Program crash
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-55-0x0000000000E10000-0x0000000000F11000-memory.dmp

Filesize
1.0MB

Download
memory/3052-56-0x0000000000E10000-0x0000000000F11000-memory.dmp

Filesize
1.0MB

Download
memory/3052-54-0x0000000000E10000-0x0000000000F11000-memory.dmp

Filesize
1.0MB

Download