05b963a57b793e556802d9afb5cf154edd8c7209cac55fafd6127c08d2e3dbb4 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:04

Sharing

Report Analysis Logs

General

Target

07411d7067ecf4359be76127069fe5ff.exe
Size

31KB
MD5

07411d7067ecf4359be76127069fe5ff
SHA1

c38f05f7b21819b156136f8e9bf8a3c3e85ef6b7
SHA256

05b963a57b793e556802d9afb5cf154edd8c7209cac55fafd6127c08d2e3dbb4
SHA512

3175af65ee1e07131cd13d380bb682a77ac7fb214b974965778cceb58f40ad584534135523a0d16699ec9a810ba9e78e2cf6dea7ea7ec7270435e94267761ddf
SSDEEP

768:wLwc4SAufkef+URbKxuek1VkMYoLDkaoc:MBrbmuJ1goLOc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	1924	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2536	1924	07411d7067ecf4359be76127069fe5ff.exe	16
PID 1924 wrote to memory of 2536	1924	07411d7067ecf4359be76127069fe5ff.exe	16
PID 1924 wrote to memory of 2536	1924	07411d7067ecf4359be76127069fe5ff.exe	16
PID 1924 wrote to memory of 2536	1924	07411d7067ecf4359be76127069fe5ff.exe	16

C:\Users\Admin\AppData\Local\Temp\07411d7067ecf4359be76127069fe5ff.exe
"C:\Users\Admin\AppData\Local\Temp\07411d7067ecf4359be76127069fe5ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 36
  2⤵
  - Program crash
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download