45bf7baa2ff48464452977fde2e1a7f4cca651cbcf0981c982c0b1735bb285fe | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:37

Sharing

Report Analysis Logs

General

Target

0187b82ee24e06d5a9acb0b6d40a5ee3.exe
Size

24KB
MD5

0187b82ee24e06d5a9acb0b6d40a5ee3
SHA1

3d456b855e42a79d68d5ee875255f4d9851cdeb5
SHA256

45bf7baa2ff48464452977fde2e1a7f4cca651cbcf0981c982c0b1735bb285fe
SHA512

e30f8218c4e98c435a451fa57ae8b893073e81fba86f50ebf78e4918756f9660d85c89f60ae235bd950601b2b66a8a04850a4bfccf78fe7cbc158cd66c58a82e
SSDEEP

768:lcbhbAqL1iV7iq89F3Zt/SJqkDF1ef24kY5k:lAA0l9F3E5efe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2188	1728	0187b82ee24e06d5a9acb0b6d40a5ee3.exe	28
PID 1728 wrote to memory of 2188	1728	0187b82ee24e06d5a9acb0b6d40a5ee3.exe	28
PID 1728 wrote to memory of 2188	1728	0187b82ee24e06d5a9acb0b6d40a5ee3.exe	28
PID 1728 wrote to memory of 2188	1728	0187b82ee24e06d5a9acb0b6d40a5ee3.exe	28

C:\Users\Admin\AppData\Local\Temp\0187b82ee24e06d5a9acb0b6d40a5ee3.exe
"C:\Users\Admin\AppData\Local\Temp\0187b82ee24e06d5a9acb0b6d40a5ee3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 88
  2⤵
  - Program crash
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download