9a35c25bfd7b964420145e3d89680131fc3d716a19cc03435d75cf061a8d2b50 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c5af0b7935da4cexeexeexeex.exe
Size

155KB
MD5

c5af0b7935da4c2ddb14973b053bc7c6
SHA1

6a70b2000d722cad8d12d896f7fc012787d7f003
SHA256

9a35c25bfd7b964420145e3d89680131fc3d716a19cc03435d75cf061a8d2b50
SHA512

fe549dec51ccdceee11d1e9f49cb346b78809f0c8829a43775c695ffa7d3ba784a506946e1ee9daab1256e4de448860668b52f6d66eb1019409212f58da4156e
SSDEEP

3072:S5K/B0toLQSNJclxwsx89TSdBgjMqqDL2/TOKyWG:ScytwtvTTSdBgQqqDL6SKG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	2384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2064	2384	c5af0b7935da4cexeexeexeex.exe	28
PID 2384 wrote to memory of 2064	2384	c5af0b7935da4cexeexeexeex.exe	28
PID 2384 wrote to memory of 2064	2384	c5af0b7935da4cexeexeexeex.exe	28
PID 2384 wrote to memory of 2064	2384	c5af0b7935da4cexeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\c5af0b7935da4cexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\c5af0b7935da4cexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 88
  2⤵
  - Program crash
  PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads