78c425e3d7962bf2dd06135f402f64ad63bd6cd59acc6c30a13d43261151131b | Triage

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:13

Sharing

Report Analysis Logs

General

Target

1885948a1c1227040269fc66db1baff2.exe
Size

193KB
MD5

1885948a1c1227040269fc66db1baff2
SHA1

71a2feb459761230a42e483769877a57321ecfd4
SHA256

78c425e3d7962bf2dd06135f402f64ad63bd6cd59acc6c30a13d43261151131b
SHA512

f73fbd79bb97c30eefb47fc37546d725f28f5dd0388120c5ad0fb43f1d39bacd6d4faf130ecee9d8dd3432d9e7bbcfe090c8e25795cea669188571501824b1f9
SSDEEP

6144:lJzb7/iDKySj3sGs2gJBGRPI3Sl+zaA3E:lp7/clpCgJBGRPTMU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2712	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2720	2712	1885948a1c1227040269fc66db1baff2.exe	29
PID 2712 wrote to memory of 2720	2712	1885948a1c1227040269fc66db1baff2.exe	29
PID 2712 wrote to memory of 2720	2712	1885948a1c1227040269fc66db1baff2.exe	29
PID 2712 wrote to memory of 2720	2712	1885948a1c1227040269fc66db1baff2.exe	29

C:\Users\Admin\AppData\Local\Temp\1885948a1c1227040269fc66db1baff2.exe
"C:\Users\Admin\AppData\Local\Temp\1885948a1c1227040269fc66db1baff2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 92
  2⤵
  - Program crash
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download