eed6333d15b85cdd9b2696d805a453508531e998604fca6259466caa5904be5c | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 15:39

Sharing

Report Analysis Logs

General

Target

518104cffc29a9fdf1e9cddc7b5133fc.exe
Size

566KB
MD5

518104cffc29a9fdf1e9cddc7b5133fc
SHA1

a1b508a17a2fdf9add1691391c8a77fe34fd84f2
SHA256

eed6333d15b85cdd9b2696d805a453508531e998604fca6259466caa5904be5c
SHA512

a05e0141804e0ca5e34b618129d8e57bcdfdb875f080eafc58f6540e83b9b0621609c7fe1e0aa7be68b9c25235cb05d6d72e72502046b2c8404775249b2d60ac
SSDEEP

6144:kpVaRXTmdo3GOBFKlRVetwmqkzq+iVnXcDeP+:k3aRDm+3GqAitPmVnD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2764	2408	518104cffc29a9fdf1e9cddc7b5133fc.exe	29
PID 2408 wrote to memory of 2764	2408	518104cffc29a9fdf1e9cddc7b5133fc.exe	29
PID 2408 wrote to memory of 2764	2408	518104cffc29a9fdf1e9cddc7b5133fc.exe	29

C:\Users\Admin\AppData\Local\Temp\518104cffc29a9fdf1e9cddc7b5133fc.exe
"C:\Users\Admin\AppData\Local\Temp\518104cffc29a9fdf1e9cddc7b5133fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 36
  2⤵
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x000000013F6D0000-0x000000013F797000-memory.dmp

Filesize
796KB

Download
memory/2408-1-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2408-2-0x000000013F6D0000-0x000000013F797000-memory.dmp

Filesize
796KB

Download