e1e9c4ef3ac4d2b1fae93095994db9dd1489e5964aaa5ca9a1524ec8a79a20cb | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:28

Sharing

Report Analysis Logs

General

Target

00e47d25d56b516258a15facd6da23d0.exe
Size

8KB
MD5

00e47d25d56b516258a15facd6da23d0
SHA1

fb7991e01140dbc0d16a8652357be8c0809ff910
SHA256

e1e9c4ef3ac4d2b1fae93095994db9dd1489e5964aaa5ca9a1524ec8a79a20cb
SHA512

12cc5a47e4bbec7e9607b94ee2f6b0786e00e103ab4a8e433c031a573978fc557a20107b310633f73aa6ade8d8d2bba796da1edd2a3e77e5f78b42c0a9e117a6
SSDEEP

192:E2MsMlVonyTGZtIp31wIiJnQ0JgRMLV/8:ABon5tU1wx138J

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2656	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2956	2656	00e47d25d56b516258a15facd6da23d0.exe	28
PID 2656 wrote to memory of 2956	2656	00e47d25d56b516258a15facd6da23d0.exe	28
PID 2656 wrote to memory of 2956	2656	00e47d25d56b516258a15facd6da23d0.exe	28
PID 2656 wrote to memory of 2956	2656	00e47d25d56b516258a15facd6da23d0.exe	28

C:\Users\Admin\AppData\Local\Temp\00e47d25d56b516258a15facd6da23d0.exe
"C:\Users\Admin\AppData\Local\Temp\00e47d25d56b516258a15facd6da23d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 148
  2⤵
  - Program crash
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2656-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download