e014003751152639fa5f5c0e9a21fd815f6de13ade70400bb0e3daf76054d0db | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/07/2023, 12:20

Sharing

Report Analysis Logs

General

Target

6bd5523d3ec986_JC.exe
Size

141KB
MD5

6bd5523d3ec986aed36a8817ba961e34
SHA1

7a6cf0400a01fed8d9f613043e4d72394d121b7a
SHA256

e014003751152639fa5f5c0e9a21fd815f6de13ade70400bb0e3daf76054d0db
SHA512

5efcb605ad26664a358c6a4bd41a96d4a976ac3f9ca9a8c2de243d2129ca305a0475186aeaaa060e122cd1021849cc6d7a993116137ee73e45a7e2c468ebc7fc
SSDEEP

3072:m5tmM+mvqQHkUs4QL1nMqqDL2/OPvdlD:m5t3Uj4QL1MqqDL6svdlD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	2912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2440	2912	6bd5523d3ec986_JC.exe	28
PID 2912 wrote to memory of 2440	2912	6bd5523d3ec986_JC.exe	28
PID 2912 wrote to memory of 2440	2912	6bd5523d3ec986_JC.exe	28
PID 2912 wrote to memory of 2440	2912	6bd5523d3ec986_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\6bd5523d3ec986_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6bd5523d3ec986_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 36
  2⤵
  - Program crash
  PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads