71daa82701014856c57c3ca152996fad65d59b0a1fdb9b7f0f7fb84f7b5a8dea | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:31

Sharing

Report Analysis Logs

General

Target

f1c4d45959b048a5e68cea9aa467be79.exe
Size

291KB
MD5

f1c4d45959b048a5e68cea9aa467be79
SHA1

b4aa20a1d70b4dfa13acfa578a3482a146dfe4bb
SHA256

71daa82701014856c57c3ca152996fad65d59b0a1fdb9b7f0f7fb84f7b5a8dea
SHA512

00dc9bba2f075a574f3d2e48d549e519767a8f402617c7ab37015ac90afe477a44a4443eaaa16b7536c29a0cc10bf5c30cb1c99e4141024cd818be7411965b20
SSDEEP

3072:RNcMVAScXR415ZCP4H47ewzUmkCYta8t+hmQz:IgASHoKwzUmMtaeQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	3048	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3060	3048	f1c4d45959b048a5e68cea9aa467be79.exe	17
PID 3048 wrote to memory of 3060	3048	f1c4d45959b048a5e68cea9aa467be79.exe	17
PID 3048 wrote to memory of 3060	3048	f1c4d45959b048a5e68cea9aa467be79.exe	17
PID 3048 wrote to memory of 3060	3048	f1c4d45959b048a5e68cea9aa467be79.exe	17

C:\Users\Admin\AppData\Local\Temp\f1c4d45959b048a5e68cea9aa467be79.exe
"C:\Users\Admin\AppData\Local\Temp\f1c4d45959b048a5e68cea9aa467be79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 552
  2⤵
  - Program crash
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-0-0x0000000000CC0000-0x0000000000D0E000-memory.dmp

Filesize
312KB

Download
memory/3048-1-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/3048-2-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download