7dffdd580d8ad324fb699db0ae34aab7eeb9b787a9ad433b709e044424d37069 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:36

Sharing

Report Analysis Logs

General

Target

01699b360647f046ada6a3d7eb80b4ed.exe
Size

63KB
MD5

01699b360647f046ada6a3d7eb80b4ed
SHA1

4ad9c0d27dfccbea7ed0f1aa13166f9a70e1368b
SHA256

7dffdd580d8ad324fb699db0ae34aab7eeb9b787a9ad433b709e044424d37069
SHA512

986ea32f5668a42c1a41a52dada2242d150df34e7172aa0a84497478b8bbb4bc2942f447cd9920a9f940d672cdd09cef7885aaca4af793869ef2713b89fcd2b2
SSDEEP

1536:QHaC7bMlYjzxuSLQKm3BIJMvpUr03/rcPZhO+ny:A7YjSkR3WJcpU2IP7By

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2168	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1708	2168	01699b360647f046ada6a3d7eb80b4ed.exe	16
PID 2168 wrote to memory of 1708	2168	01699b360647f046ada6a3d7eb80b4ed.exe	16
PID 2168 wrote to memory of 1708	2168	01699b360647f046ada6a3d7eb80b4ed.exe	16
PID 2168 wrote to memory of 1708	2168	01699b360647f046ada6a3d7eb80b4ed.exe	16

C:\Users\Admin\AppData\Local\Temp\01699b360647f046ada6a3d7eb80b4ed.exe
"C:\Users\Admin\AppData\Local\Temp\01699b360647f046ada6a3d7eb80b4ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 36
  2⤵
  - Program crash
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download