71b21f1296bb3815d8345232a1b26cd743597a315a0f9dcb399e92fc66d03639 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

182bca2ad75bd5e5683643f43b481665.exe
Size

84KB
MD5

182bca2ad75bd5e5683643f43b481665
SHA1

288ad9c607c5acbe31345a782263fe0eebbf0d89
SHA256

71b21f1296bb3815d8345232a1b26cd743597a315a0f9dcb399e92fc66d03639
SHA512

6354f813908c6da4f801bbaf947fb784d48cdab9dd0e0bd992a67e4433006ed13f92691158a30121198d946857fb3dcd166a55909bc9d7e6e96aa9cb5a36d771
SSDEEP

768:6//rtA5b5l+3XHgvAVGjgUkH7ijA3rWbzFQK/6bKoJP:+wb+nAYlD3rWWKgKoJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	3060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1636	3060	182bca2ad75bd5e5683643f43b481665.exe	28
PID 3060 wrote to memory of 1636	3060	182bca2ad75bd5e5683643f43b481665.exe	28
PID 3060 wrote to memory of 1636	3060	182bca2ad75bd5e5683643f43b481665.exe	28
PID 3060 wrote to memory of 1636	3060	182bca2ad75bd5e5683643f43b481665.exe	28

C:\Users\Admin\AppData\Local\Temp\182bca2ad75bd5e5683643f43b481665.exe
"C:\Users\Admin\AppData\Local\Temp\182bca2ad75bd5e5683643f43b481665.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 148
  2⤵
  - Program crash
  PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3060-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download