627aba23d7614f56c81eca6cbef0c9dca16cc392f1e1cb7e5e2683011f6e5dac | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09b513feebb292exe_JC.exe
Size

952KB
MD5

09b513feebb29295bc62de789da4c12b
SHA1

bd5bdc2883237311f233d7dd577811894fb6876a
SHA256

627aba23d7614f56c81eca6cbef0c9dca16cc392f1e1cb7e5e2683011f6e5dac
SHA512

56581bd24874398a60037ed4b5b5e5130d889b392f64c050e50a6250e514c73ba619749e3b56a1096b5ea43a37df74aab22876ac9f80c85787f9c36fd880ff79
SSDEEP

24576:WEvTkZojq3SbHZaGTQr8bJPy4WfGRo9iQOGoCoZAj:pTrbTAEPy4WfiyiFdOj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	2528	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1932	2528	09b513feebb292exe_JC.exe	28
PID 2528 wrote to memory of 1932	2528	09b513feebb292exe_JC.exe	28
PID 2528 wrote to memory of 1932	2528	09b513feebb292exe_JC.exe	28
PID 2528 wrote to memory of 1932	2528	09b513feebb292exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\09b513feebb292exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\09b513feebb292exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 44
  2⤵
  - Program crash
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-54-0x0000000000B30000-0x0000000000C2C660-memory.dmp

Filesize
1009KB

Download
memory/2528-56-0x0000000000B30000-0x0000000000C2C660-memory.dmp

Filesize
1009KB

Download
memory/2528-55-0x0000000000B30000-0x0000000000C2C660-memory.dmp

Filesize
1009KB

Download
memory/2528-57-0x0000000000B30000-0x0000000000C2C660-memory.dmp

Filesize
1009KB

Download