fd4f3a1625d7aad442cfc6379ba1d489e19b5d3f35423056c584be47c09e2666 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:52

Sharing

Report Analysis Logs

General

Target

j1742353.exe
Size

399KB
MD5

90400dcb4a3f3a3f212c594dcc4a7274
SHA1

d1cb9e472aeddd443bbe1924a1d690dec7199e92
SHA256

fd4f3a1625d7aad442cfc6379ba1d489e19b5d3f35423056c584be47c09e2666
SHA512

381a9f96776f70450938547801be797fd6f43f7339f2259665e503ba137ba4577da03e1ced85505fedb5eac691ba4dadc61b2bd0ee8ac09b9e9645166be7748c
SSDEEP

6144:bvYjEk2jicP5iOo2T8VrSd/sUAORcluCLGSju7OERcePT0QXNs1Sa:bvYpqiG59ouTcrGSedQQ9s1Sa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2960 2100 WerFault.exe j1742353.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

j1742353.exe

description	pid	process	target process
PID 2100 wrote to memory of 2960	2100	j1742353.exe	WerFault.exe
PID 2100 wrote to memory of 2960	2100	j1742353.exe	WerFault.exe
PID 2100 wrote to memory of 2960	2100	j1742353.exe	WerFault.exe
PID 2100 wrote to memory of 2960	2100	j1742353.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\j1742353.exe
"C:\Users\Admin\AppData\Local\Temp\j1742353.exe"
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 52
- Program crash
PID:2960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...