79b49da62c269c851e7cb0f77057b8ac2a1a649bbf613a4354d241cb7cf2d8d3 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17-07-2023 14:40

Sharing

Report Analysis Logs

General

Target

8f2438c22bcf2f_JC.exe
Size

2.1MB
MD5

8f2438c22bcf2f77f3c641f4e1c7eac3
SHA1

a60ca50b05dcaf6b8a33b49a1b36b7f3a2892ca4
SHA256

79b49da62c269c851e7cb0f77057b8ac2a1a649bbf613a4354d241cb7cf2d8d3
SHA512

183bc5e324c6581c4a2bbdd94dbb010e80cc6981a81f66befc98d69c87e3593ac2769f8db3d16e09c73884ebea0a940bb7fceff88ca40ac16218176124632050
SSDEEP

49152:5FK18X4jrBVwVIqpwGS+OzJTAwfJtH7/tvIsh3ANkTTl:k8X4jrBV6SLtH7B13AM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1260	2492	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1260	2492	8f2438c22bcf2f_JC.exe	28
PID 2492 wrote to memory of 1260	2492	8f2438c22bcf2f_JC.exe	28
PID 2492 wrote to memory of 1260	2492	8f2438c22bcf2f_JC.exe	28
PID 2492 wrote to memory of 1260	2492	8f2438c22bcf2f_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8f2438c22bcf2f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8f2438c22bcf2f_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 116
  2⤵
  - Program crash
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads