e182b7e3581edae5037e0d10c351dcfc12d06801f461f33ab635585f9a0f2227 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0342d3191288b62b67b72cc3ddd37c86.exe
Size

255KB
MD5

0342d3191288b62b67b72cc3ddd37c86
SHA1

a1a25a0bda79397c112b26b6381ba541d738111e
SHA256

e182b7e3581edae5037e0d10c351dcfc12d06801f461f33ab635585f9a0f2227
SHA512

917def23ab45e28575fc617ee3c952fa5b1e41f9873c33d129dbbd6c2abb81d6fe3b52e8c6ab9aecc3e1b8efe14ace82fbf2b39435e4931fd0a4188b2c6448b0
SSDEEP

6144:Gke9W/sawJNVq4qLBspeYKngBMGtdCikdWblW:qrvVq47Xs6dV+6W

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1720	1732	0342d3191288b62b67b72cc3ddd37c86.exe	28
PID 1732 wrote to memory of 1720	1732	0342d3191288b62b67b72cc3ddd37c86.exe	28
PID 1732 wrote to memory of 1720	1732	0342d3191288b62b67b72cc3ddd37c86.exe	28
PID 1732 wrote to memory of 1720	1732	0342d3191288b62b67b72cc3ddd37c86.exe	28

C:\Users\Admin\AppData\Local\Temp\0342d3191288b62b67b72cc3ddd37c86.exe
"C:\Users\Admin\AppData\Local\Temp\0342d3191288b62b67b72cc3ddd37c86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 92
  2⤵
  - Program crash
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads