656e571691d862af6c22c1cc0bb65407ac6c4c88e10be5aff64e095b7f23bd9e | Triage

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 03:07

Sharing

Report Analysis Logs

General

Target

AJJAAJ.exe
Size

469KB
MD5

4dbc01ed11356b31e741e01953fe7706
SHA1

739e00176e3b9c574679a64ede090b43e0ac2f66
SHA256

656e571691d862af6c22c1cc0bb65407ac6c4c88e10be5aff64e095b7f23bd9e
SHA512

374f2226d9f58be82c42a001f2818ecff4aec45e55ba24bc588624b58bc24e5760e675669b451b6ac8a4b8a736c89adeb09e5cef5be9845eb4078f8afe248000
SSDEEP

12288:gmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSwn9:giLJbpI7I2WhQqZ7w9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2320	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2268	2320	AJJAAJ.exe	28
PID 2320 wrote to memory of 2268	2320	AJJAAJ.exe	28
PID 2320 wrote to memory of 2268	2320	AJJAAJ.exe	28
PID 2320 wrote to memory of 2268	2320	AJJAAJ.exe	28

C:\Users\Admin\AppData\Local\Temp\AJJAAJ.exe
"C:\Users\Admin\AppData\Local\Temp\AJJAAJ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 172
  2⤵
  - Program crash
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads