6cd6ab402de04afd532bd198c30f4e1a00dd710f962a8dce6b4d5c4ee9cb6f2a | Triage

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09-07-2023 08:32

Sharing

Report Analysis Logs

General

Target

a0160d18fe9ab9exeexeexeex.exe
Size

144KB
MD5

a0160d18fe9ab92fe0d10ae8aee7547b
SHA1

662642abe3fe021b63ff6a20e4ad0440a513be49
SHA256

6cd6ab402de04afd532bd198c30f4e1a00dd710f962a8dce6b4d5c4ee9cb6f2a
SHA512

dbfd66608707874bd13ce862409655c358e07e7c194ddc9e5d97479e7cd8fd0b66f652bb08e810166a066c1db110e78270fb4f0abb68551cacf6b474432ea265
SSDEEP

3072:ZqJogYkcSNm9VoDPyhnBhMFE5fv0PfFYZZ:Zq2kc4m9iDeBkEt0PfaH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	1936	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2984	1936	a0160d18fe9ab9exeexeexeex.exe	29
PID 1936 wrote to memory of 2984	1936	a0160d18fe9ab9exeexeexeex.exe	29
PID 1936 wrote to memory of 2984	1936	a0160d18fe9ab9exeexeexeex.exe	29
PID 1936 wrote to memory of 2984	1936	a0160d18fe9ab9exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\a0160d18fe9ab9exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\a0160d18fe9ab9exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 88
  2⤵
  - Program crash
  PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads