5acddc0a92e5fa345c615cd0aca286e94f0419a1758ac413334a25689a2c6952 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/10/2023, 20:14

Sharing

Report Analysis Logs

General

Target

FirefoxSetup1.exe
Size

6.7MB
MD5

49180d1fcc2957b893d17da38513a598
SHA1

38464b605ba71cfb526b6127e49ea9299c6d2f49
SHA256

5acddc0a92e5fa345c615cd0aca286e94f0419a1758ac413334a25689a2c6952
SHA512

92beb42825597f0e2b3210c9f7a67b11407d46332fb3db8dc7af2b69579031d3a59bd36fce4e5c569da3f394b44585702073b4cba719a7f10f1b1035f92ef5c9
SSDEEP

196608:O5nv+zsdsMI5982TRBwBttDiJzsE15dU5yuSZRl51:O5v+zmsMIr82TrwBtAKCS36RL1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	2204	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2108	2204	FirefoxSetup1.exe	28
PID 2204 wrote to memory of 2108	2204	FirefoxSetup1.exe	28
PID 2204 wrote to memory of 2108	2204	FirefoxSetup1.exe	28
PID 2204 wrote to memory of 2108	2204	FirefoxSetup1.exe	28

C:\Users\Admin\AppData\Local\Temp\FirefoxSetup1.exe
"C:\Users\Admin\AppData\Local\Temp\FirefoxSetup1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 36
  2⤵
  - Program crash
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-0-0x00000000008C0000-0x000000000090E000-memory.dmp

Filesize
312KB

Download