cddb634d5f2132e4307a9236355d8b2be827c3cd98b0b69de78e246e8c49ad72 | Triage

Analysis

max time kernel
100s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 18:59

Sharing

Report Analysis Logs

General

Target

df249a4b8ef05eexeexeexeex.exe
Size

520KB
MD5

df249a4b8ef05e444a103f51e06c48df
SHA1

38e71ea305664b180140c62ef061de5672e95e7b
SHA256

cddb634d5f2132e4307a9236355d8b2be827c3cd98b0b69de78e246e8c49ad72
SHA512

888d4f0666e6e5ee1efb4c43e6229d851977dd491592bad997a0242229e4b203e9b33aa396cd367dc97e22557413d7429c6011ca067e219cdbd73e6cb3f87107
SSDEEP

12288:GDl28iJRz2E1mvBkXoNcoi4dIRJRhMlJxPNZ:GDcDJAE1d8c4+JRhM3RN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	1684	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1664	1684	df249a4b8ef05eexeexeexeex.exe	28
PID 1684 wrote to memory of 1664	1684	df249a4b8ef05eexeexeexeex.exe	28
PID 1684 wrote to memory of 1664	1684	df249a4b8ef05eexeexeexeex.exe	28
PID 1684 wrote to memory of 1664	1684	df249a4b8ef05eexeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\df249a4b8ef05eexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\df249a4b8ef05eexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 132
  2⤵
  - Program crash
  PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads