cd224de4ba6ebcdd49c59535b63c83aa003072a577aee22ae2f72ee41cc2d31a | Triage

Analysis

max time kernel
30s
max time network
35s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08-07-2023 18:27

Sharing

Report Analysis Logs

General

Target

9b7623cd82eea0exeexeexeex.exe
Size

139KB
MD5

9b7623cd82eea05b6f9aaba29c4d7d94
SHA1

dfdee6142a4aa3a9ad7733a53991b75c1575eb7c
SHA256

cd224de4ba6ebcdd49c59535b63c83aa003072a577aee22ae2f72ee41cc2d31a
SHA512

6fb1c5370d6258c1e51b08dd6860d84267b81926e31e7f1754daca2f57a931f2a293f3331d6c22ea3a8039f67a23928a80e259d3515750b9c516e4e58915e6f4
SSDEEP

3072:3y8p5g3yif0dMozutg3C3MqqDL2/LRfvdn:3y8p57LV3DqqDL65vdn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	3044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3064	3044	9b7623cd82eea0exeexeexeex.exe	28
PID 3044 wrote to memory of 3064	3044	9b7623cd82eea0exeexeexeex.exe	28
PID 3044 wrote to memory of 3064	3044	9b7623cd82eea0exeexeexeex.exe	28
PID 3044 wrote to memory of 3064	3044	9b7623cd82eea0exeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\9b7623cd82eea0exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\9b7623cd82eea0exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 88
  2⤵
  - Program crash
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads