71d88efa41b19573641a56fbbb1bcfb15ace62d9d1eddd156bd8039ced1e8d6b | Triage

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 20:41

Sharing

Report Analysis Logs

General

Target

10.1.exe
Size

136KB
MD5

9ad1a670516e5a1113807ea35474e7f0
SHA1

9426b7e574e78e9f6bc48c9b52164d0064666a8e
SHA256

71d88efa41b19573641a56fbbb1bcfb15ace62d9d1eddd156bd8039ced1e8d6b
SHA512

b56a4145f2fe67455566812277f619dfcb52887639d5d41eec5b3498f251ef7557732ee9e0e8a9b83c23a9b63d13b2620db5b2dca78e64c4f4367c2d93271fd3
SSDEEP

3072:lrIYOLtPjGbFpk1I9Dyils3F9snHyl8ykd:YjapZw3F9srL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2700	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2364	2700	10.1.exe	29
PID 2700 wrote to memory of 2364	2700	10.1.exe	29
PID 2700 wrote to memory of 2364	2700	10.1.exe	29
PID 2700 wrote to memory of 2364	2700	10.1.exe	29

C:\Users\Admin\AppData\Local\Temp\10.1.exe
"C:\Users\Admin\AppData\Local\Temp\10.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 52
  2⤵
  - Program crash
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x0000000000F30000-0x0000000000F5A000-memory.dmp

Filesize
168KB

Download