dee8fa822a3b681e258b31d14062c08e2a5ed93d8f19be06c3b31f074d5c91d6 | Triage

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08-07-2023 17:57

Sharing

Report Analysis Logs

General

Target

610bec1c696a12exeexeexeex.exe
Size

155KB
MD5

610bec1c696a1228af5830f4a026ee5b
SHA1

23cfd2c93dcb36bb71cb42c0c5e776ff0df4ddac
SHA256

dee8fa822a3b681e258b31d14062c08e2a5ed93d8f19be06c3b31f074d5c91d6
SHA512

b0b319b363c5f7549f46c08171ecd78cdcb1dc58f33c79f5a11f20cee97ef93d2f0fcaa275910675c033380db1852f72e30bf1870c4bc2a2479be992b59ff15f
SSDEEP

3072:S5K/B0toLLSNJYlxwsx89TSdBgjMqqDL2/TOKr4G:ScytwWfTTSdBgQqqDL6SKZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2364	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2376	2364	610bec1c696a12exeexeexeex.exe	29
PID 2364 wrote to memory of 2376	2364	610bec1c696a12exeexeexeex.exe	29
PID 2364 wrote to memory of 2376	2364	610bec1c696a12exeexeexeex.exe	29
PID 2364 wrote to memory of 2376	2364	610bec1c696a12exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\610bec1c696a12exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\610bec1c696a12exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 88
  2⤵
  - Program crash
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads