e6bf2e44d0addd93ede445f85bfd7eed8272fb602bedfb93aff0983b63573df2 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:40

Sharing

Report Analysis Logs

General

Target

01baa85474c0f5e3ae8af673f72f75ad.exe
Size

122KB
MD5

01baa85474c0f5e3ae8af673f72f75ad
SHA1

ace8d94d9c8bd934be02ba420f2b5316afae227e
SHA256

e6bf2e44d0addd93ede445f85bfd7eed8272fb602bedfb93aff0983b63573df2
SHA512

b08e8106bd94758250340fc321586e84846c39da5bd01697a118689e6dd61fbe40158636a5fb968b20a88063a6ab4b30cb3a497f3b18e8b05e51cec676764a7a
SSDEEP

3072:qkAw+zhjdRmSZiAItSOoUvMR1Yd4uneSILqenCP:Owsh/7PSoUvMVune5DnCP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	2912	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2932	2912	01baa85474c0f5e3ae8af673f72f75ad.exe	25
PID 2912 wrote to memory of 2932	2912	01baa85474c0f5e3ae8af673f72f75ad.exe	25
PID 2912 wrote to memory of 2932	2912	01baa85474c0f5e3ae8af673f72f75ad.exe	25
PID 2912 wrote to memory of 2932	2912	01baa85474c0f5e3ae8af673f72f75ad.exe	25

C:\Users\Admin\AppData\Local\Temp\01baa85474c0f5e3ae8af673f72f75ad.exe
"C:\Users\Admin\AppData\Local\Temp\01baa85474c0f5e3ae8af673f72f75ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 92
  2⤵
  - Program crash
  PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download