ea06f7fefd086216317b33f71f6fa63be5d6dfa10b51628d001f0bef7740da15 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14-07-2023 12:26

Sharing

Report Analysis Logs

General

Target

17179334eacc86exe_JC.exe
Size

197KB
MD5

17179334eacc8641a33e0433a804b450
SHA1

6b4da4e0f23e4df79d78500ced1cf88f4562e5fd
SHA256

ea06f7fefd086216317b33f71f6fa63be5d6dfa10b51628d001f0bef7740da15
SHA512

c834bfe0c91ffc18a6415fe1896b661d76dce346dbdaf5eebf867932491276ec28551a11a621b240fe179d69f4e8ba34b77c11ec07a73f474fa19a7b4981483f
SSDEEP

6144:V8MbaaXR2jw4t2QuvsXKKNYaOeX2KVBqyts95LUlhCSF:pLREqyts9pwhf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1804	2572	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1804	2572	17179334eacc86exe_JC.exe	28
PID 2572 wrote to memory of 1804	2572	17179334eacc86exe_JC.exe	28
PID 2572 wrote to memory of 1804	2572	17179334eacc86exe_JC.exe	28
PID 2572 wrote to memory of 1804	2572	17179334eacc86exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\17179334eacc86exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\17179334eacc86exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 36
  2⤵
  - Program crash
  PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2572-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download