f18c2599fd43946c4511aac2241c42c5f7e840bc97bcff9b3e1c86b4f7a1d7c5 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14-07-2023 12:09

Sharing

Report Analysis Logs

General

Target

166b6057613d82exe_JC.exe
Size

2.1MB
MD5

166b6057613d82aff28cf7f0d0699b85
SHA1

e356753f82c54cba9ac8e3e997a2b55c5dba0c92
SHA256

f18c2599fd43946c4511aac2241c42c5f7e840bc97bcff9b3e1c86b4f7a1d7c5
SHA512

dee434685256b32e3ed33d480ada448be550b9971bfa2e4537f746266bcafe4555a04d7ab41d8b96e340a325c00e7397a28384ecdfdacdac680eec4a52fef64b
SSDEEP

49152:09yiCJ5rFwnANZGEXeZ+96x8egOSDAmosh3ANkTTl:bJ5rFwnApedgOS9V3AM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	2300	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1556	2300	166b6057613d82exe_JC.exe	28
PID 2300 wrote to memory of 1556	2300	166b6057613d82exe_JC.exe	28
PID 2300 wrote to memory of 1556	2300	166b6057613d82exe_JC.exe	28
PID 2300 wrote to memory of 1556	2300	166b6057613d82exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\166b6057613d82exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\166b6057613d82exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 116
  2⤵
  - Program crash
  PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads