004acc00202eccd733559315ebabb1dc836c8373cc87e3da26f96b3c4e3d11ca | Triage

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 17:00

Sharing

Report Analysis Logs

General

Target

0712e20466cc6a703f588477e05dd91b.exe
Size

28KB
MD5

0712e20466cc6a703f588477e05dd91b
SHA1

4b74e7a85ad5eac57dbc52509d5c0aa3b26b0e9a
SHA256

004acc00202eccd733559315ebabb1dc836c8373cc87e3da26f96b3c4e3d11ca
SHA512

f9c4b4a9df92cc62181c72303a0842da535207d27cdfcfd9f59408d01cbc774139cfce5ed18402f8079bd6b5713a3f96439f12bd856973ad556f38bea5abed3f
SSDEEP

768:GxSdwlW0Tplru8R/rA0JFree5L0b/9CYps:GxSSpP6KTvFrM/9Lps

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2780	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2376	2780	0712e20466cc6a703f588477e05dd91b.exe	28
PID 2780 wrote to memory of 2376	2780	0712e20466cc6a703f588477e05dd91b.exe	28
PID 2780 wrote to memory of 2376	2780	0712e20466cc6a703f588477e05dd91b.exe	28
PID 2780 wrote to memory of 2376	2780	0712e20466cc6a703f588477e05dd91b.exe	28

C:\Users\Admin\AppData\Local\Temp\0712e20466cc6a703f588477e05dd91b.exe
"C:\Users\Admin\AppData\Local\Temp\0712e20466cc6a703f588477e05dd91b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 36
  2⤵
  - Program crash
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download