a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 23:11

Sharing

Report Analysis Logs

General

Target

Dump/dump1.exe
Size

268KB
MD5

4ef5f0a660c9ae3e32eb109e1e7bfa30
SHA1

b02b7fde30930161726fdd7e872da43b271f2c3b
SHA256

db8c0fc8427546ed54664fba24bdc7aa335eedb34b21c0d9a030dbc4f2bd7aef
SHA512

6a49b7d2c46e072f329f75b0ab74e011aee16cd35ba9a83734294fcbb3ad73539a8545f27695d58aa9d9150114c8f344a3b193b2e6005edb3085eba0906e9a81
SSDEEP

6144:uj7pn+5J7GRQtr3XMxJR2O5jRQtr3Xxw+:uj47mor3XMxJL5dor3X5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1988	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1912	1988	dump1.exe	28
PID 1988 wrote to memory of 1912	1988	dump1.exe	28
PID 1988 wrote to memory of 1912	1988	dump1.exe	28
PID 1988 wrote to memory of 1912	1988	dump1.exe	28

C:\Users\Admin\AppData\Local\Temp\Dump\dump1.exe
"C:\Users\Admin\AppData\Local\Temp\Dump\dump1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 116
  2⤵
  - Program crash
  PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads