74886acb42e35583993adf2df92272ede38e8a4a3a4a44608e02b38d7b1a2f2e | Triage

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 06:31

Sharing

Report Analysis Logs

General

Target

e150446405fcffexeexeexeex.exe
Size

2.1MB
MD5

e150446405fcffb91b4dfe60c4139df5
SHA1

792b74d1764bfa1d0ff4e5470da92084f1064c96
SHA256

74886acb42e35583993adf2df92272ede38e8a4a3a4a44608e02b38d7b1a2f2e
SHA512

401b600e5fd9ae9070d1195d441fd9416abafdc4dfb82578c3a9be89ab7ce2a6407b9fed244974a8cfc7cab09509ef088b0675335881f709a7c81295b2f233e7
SSDEEP

49152:p9yiCJ5rFwnANZGEXeZ+9Sx8egOSDAmosh3ANkTTl:CJ5rFwnApe1gOS9V3AM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
568	876	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 568	876	e150446405fcffexeexeexeex.exe	28
PID 876 wrote to memory of 568	876	e150446405fcffexeexeexeex.exe	28
PID 876 wrote to memory of 568	876	e150446405fcffexeexeexeex.exe	28
PID 876 wrote to memory of 568	876	e150446405fcffexeexeexeex.exe	28

C:\Users\Admin\AppData\Local\Temp\e150446405fcffexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\e150446405fcffexeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 116
  2⤵
  - Program crash
  PID:568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads