fdae780bbece83390085992b9e93c74be3393545f49d34a6f23f2ccfd969da91 | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:38

Sharing

Report Analysis Logs

General

Target

f5aba8dfecfc3e3f684071cba691572f.exe
Size

55KB
MD5

f5aba8dfecfc3e3f684071cba691572f
SHA1

dd10c34af3eb340e0b139a583ce98653abd9f84a
SHA256

fdae780bbece83390085992b9e93c74be3393545f49d34a6f23f2ccfd969da91
SHA512

858f9620783717e007e38233fdb7eb9fc4fb78586ce84cc0f22e8511eee7c45ef0668383ac8ceac8612744209ab4e9bf15b72311d6b2552ded35adb430ba3f38
SSDEEP

1536:mq2uEXpMjYpfuv39Pmx2gd3tRthVWLnE:mDugMk1y8fthEE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1356	2220	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1356	2220	f5aba8dfecfc3e3f684071cba691572f.exe	28
PID 2220 wrote to memory of 1356	2220	f5aba8dfecfc3e3f684071cba691572f.exe	28
PID 2220 wrote to memory of 1356	2220	f5aba8dfecfc3e3f684071cba691572f.exe	28
PID 2220 wrote to memory of 1356	2220	f5aba8dfecfc3e3f684071cba691572f.exe	28

C:\Users\Admin\AppData\Local\Temp\f5aba8dfecfc3e3f684071cba691572f.exe
"C:\Users\Admin\AppData\Local\Temp\f5aba8dfecfc3e3f684071cba691572f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 596
  2⤵
  - Program crash
  PID:1356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000000070000-0x0000000000084000-memory.dmp

Filesize
80KB

Download
memory/2220-1-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2220-2-0x0000000000210000-0x0000000000228000-memory.dmp

Filesize
96KB

Download
memory/2220-3-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download