223d7eb3bc440170b6f584fe81b49c0291fe3bbd0e3a6652178a9545312adcb6 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 09:07

Sharing

Report Analysis Logs

General

Target

a6855d6825f776exeexeexeex.exe
Size

203KB
MD5

a6855d6825f7762bd170139e30852aa4
SHA1

1d228bdee8a05ea36cd80686da65bacc577f54bd
SHA256

223d7eb3bc440170b6f584fe81b49c0291fe3bbd0e3a6652178a9545312adcb6
SHA512

0909b3575e2ed70b1239c0a7e106aab512de87cd2b62233adcd2017ec64b9527997ba32eeab2c2a5ab300f9a92aa25919613063ef259f511d98e320339c94525
SSDEEP

6144:W/O/Za4K4Rk3oWnkavI9ovY3Im9J3kHsnHMUvgH8hSN0:7ZnK93Bn7vIkY3IIesH8H8g

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2120	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3068	2120	a6855d6825f776exeexeexeex.exe	27
PID 2120 wrote to memory of 3068	2120	a6855d6825f776exeexeexeex.exe	27
PID 2120 wrote to memory of 3068	2120	a6855d6825f776exeexeexeex.exe	27
PID 2120 wrote to memory of 3068	2120	a6855d6825f776exeexeexeex.exe	27

C:\Users\Admin\AppData\Local\Temp\a6855d6825f776exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\a6855d6825f776exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 36
  2⤵
  - Program crash
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-54-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download