fc5fd5e5659a9feb3db8a32ced8ff55e37059013af5f425046b3e464a8042e08 | Triage

Analysis

max time kernel
139s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 19:21

Sharing

Report Analysis Logs

General

Target

b7b54e77acad98exeexeexeex.exe
Size

155KB
MD5

b7b54e77acad98d3f9180b9d11926813
SHA1

22f9f82bb2f8cf6034b286f41aaaa4de8e6c09d4
SHA256

fc5fd5e5659a9feb3db8a32ced8ff55e37059013af5f425046b3e464a8042e08
SHA512

32799324b08188116ade2ce3a40d2bb1c02b2dcefca2bb0b9aba3823ad3f6b44276f250a7d3f200e77d0fc4cd5d8c4395c8de08418f9ace3786db3a6498c50e4
SSDEEP

3072:l5K/B0toLlSNJjlZHQsozTS+SMqqDL2/TrK+CG:lcytw4l1yTS+xqqDL6HKO

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1888	2252	WerFault.exe	84
2420	2252	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1888	2252	b7b54e77acad98exeexeexeex.exe	87
PID 2252 wrote to memory of 1888	2252	b7b54e77acad98exeexeexeex.exe	87
PID 2252 wrote to memory of 1888	2252	b7b54e77acad98exeexeexeex.exe	87

C:\Users\Admin\AppData\Local\Temp\b7b54e77acad98exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\b7b54e77acad98exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 252
  2⤵
  - Program crash
  PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 252
  2⤵
  - Program crash
  PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2252 -ip 2252
1⤵
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads