6ff6e90d2ebccdb56832212ba15386f15c4d3a2199e3cf7597b542a9525b064e | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14/07/2023, 15:58

Sharing

Report Analysis Logs

General

Target

29be445f478586exeexe_JC.exe
Size

337KB
MD5

29be445f478586f917d0f7a6cee02722
SHA1

0697ecc765d4431caf3390eed46a4a44b017b683
SHA256

6ff6e90d2ebccdb56832212ba15386f15c4d3a2199e3cf7597b542a9525b064e
SHA512

e1b03dfef4f6915050080917376871487e019ba3c64ed60c1bae4538513966f03b29bb610a750d35bdc73da4ca9779efd213e5f61903a2b18da174a9a3c3f4e4
SSDEEP

6144:jXulboUPovpXw4CcUbTqnl0dMtWjHlPwRiLkT1d+Whwk4I:DulbMOR2ea0jViiL4d+BB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	2208	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2580	2208	29be445f478586exeexe_JC.exe	28
PID 2208 wrote to memory of 2580	2208	29be445f478586exeexe_JC.exe	28
PID 2208 wrote to memory of 2580	2208	29be445f478586exeexe_JC.exe	28
PID 2208 wrote to memory of 2580	2208	29be445f478586exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\29be445f478586exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\29be445f478586exeexe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 120
  2⤵
  - Program crash
  PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads