74e97c1590db5ac7681d8b4695c4d47f2353c71768fcfc5a11c5137109a3716e | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:27

Sharing

Report Analysis Logs

General

Target

05afcd84911127b807919b93766ff022.exe
Size

52KB
MD5

05afcd84911127b807919b93766ff022
SHA1

ceeb7fd568e62eb9cb1e29a68ddc7f1b4b374ffc
SHA256

74e97c1590db5ac7681d8b4695c4d47f2353c71768fcfc5a11c5137109a3716e
SHA512

eefd698b87d467942a3672b7790d65babfe438c24b4fb8e139adb6c498e82bd73b0fa210835671f526a49a245f3d92bcc6ed86bd1962ed1e791e90167ae582b0
SSDEEP

768:FdEJb16hnGqvxjtgTVH7NHaurxmWXOQfwoObuPb77e:FdEgXRml5lXAoO+H7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	2224	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2344	2224	05afcd84911127b807919b93766ff022.exe	17
PID 2224 wrote to memory of 2344	2224	05afcd84911127b807919b93766ff022.exe	17
PID 2224 wrote to memory of 2344	2224	05afcd84911127b807919b93766ff022.exe	17
PID 2224 wrote to memory of 2344	2224	05afcd84911127b807919b93766ff022.exe	17

C:\Users\Admin\AppData\Local\Temp\05afcd84911127b807919b93766ff022.exe
"C:\Users\Admin\AppData\Local\Temp\05afcd84911127b807919b93766ff022.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 144
  2⤵
  - Program crash
  PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download