00d902a704df055cb78ea9b66e7d4f276fc1d0a785ec4b42a303eb3624f80df7 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13a7821a5f168063541e2f2096112b91.exe
Size

115KB
MD5

13a7821a5f168063541e2f2096112b91
SHA1

1007d316229db28314328cd0b250518ae0e9bd7d
SHA256

00d902a704df055cb78ea9b66e7d4f276fc1d0a785ec4b42a303eb3624f80df7
SHA512

b350a1f80b821eb06e9bf7e220705f126b8692d9b6c9713e93fa30a607531d3a72094199e9fd7683b52c48e3a011cc398be8203caebac7cde92399f0a11c7455
SSDEEP

3072:rvkGO9TMGNG0WycxnvdwOxQZbGL6msFhx2DmaA2:TkGmMGky+iO+GCh0DHz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2452	3012	13a7821a5f168063541e2f2096112b91.exe	28
PID 3012 wrote to memory of 2452	3012	13a7821a5f168063541e2f2096112b91.exe	28
PID 3012 wrote to memory of 2452	3012	13a7821a5f168063541e2f2096112b91.exe	28
PID 3012 wrote to memory of 2452	3012	13a7821a5f168063541e2f2096112b91.exe	28

C:\Users\Admin\AppData\Local\Temp\13a7821a5f168063541e2f2096112b91.exe
"C:\Users\Admin\AppData\Local\Temp\13a7821a5f168063541e2f2096112b91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 116
  2⤵
  - Program crash
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads