fc5fd5e5659a9feb3db8a32ced8ff55e37059013af5f425046b3e464a8042e08 | Triage

Analysis

max time kernel
65s
max time network
76s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 19:21

Sharing

Report Analysis Logs

General

Target

b7b54e77acad98exeexeexeex.exe
Size

155KB
MD5

b7b54e77acad98d3f9180b9d11926813
SHA1

22f9f82bb2f8cf6034b286f41aaaa4de8e6c09d4
SHA256

fc5fd5e5659a9feb3db8a32ced8ff55e37059013af5f425046b3e464a8042e08
SHA512

32799324b08188116ade2ce3a40d2bb1c02b2dcefca2bb0b9aba3823ad3f6b44276f250a7d3f200e77d0fc4cd5d8c4395c8de08418f9ace3786db3a6498c50e4
SSDEEP

3072:l5K/B0toLlSNJjlZHQsozTS+SMqqDL2/TrK+CG:lcytw4l1yTS+xqqDL6HKO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	1740	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2872	1740	b7b54e77acad98exeexeexeex.exe	27
PID 1740 wrote to memory of 2872	1740	b7b54e77acad98exeexeexeex.exe	27
PID 1740 wrote to memory of 2872	1740	b7b54e77acad98exeexeexeex.exe	27
PID 1740 wrote to memory of 2872	1740	b7b54e77acad98exeexeexeex.exe	27

C:\Users\Admin\AppData\Local\Temp\b7b54e77acad98exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\b7b54e77acad98exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 88
  2⤵
  - Program crash
  PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads