48cdcc6d9774369fdc7dcf6626d6267fb112af205d5b030e799d87ebd91c8b28 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 13:39

Sharing

Report Analysis Logs

General

Target

e9cf2367f87414exe_JC.exe
Size

2.1MB
MD5

e9cf2367f87414fa1dac3f30589ef577
SHA1

d4c7a660c6ba09fb53a2933e05acd52a9498359e
SHA256

48cdcc6d9774369fdc7dcf6626d6267fb112af205d5b030e799d87ebd91c8b28
SHA512

908fc6e4b8a54900e9a751ed1f7007b6c0b505445e681ab1a959b73e04ef4aa272e69211ab76e6faec12c5b91319ab0bff0a3bb939f503e569ed2dbbc03400c5
SSDEEP

49152:jxFUBcFc5BBxAxBiewxpn6cb2WTLwvEXXYvsh3ANkTTl:6cFc5BBxMwxFwvEYM3AM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	2468	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2820	2468	e9cf2367f87414exe_JC.exe	28
PID 2468 wrote to memory of 2820	2468	e9cf2367f87414exe_JC.exe	28
PID 2468 wrote to memory of 2820	2468	e9cf2367f87414exe_JC.exe	28
PID 2468 wrote to memory of 2820	2468	e9cf2367f87414exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\e9cf2367f87414exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e9cf2367f87414exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 116
  2⤵
  - Program crash
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads