57b00af123386e3b7ec1ad16d1452d96005ee65eb0ad40425a085edc5f443973 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:08

Sharing

Report Analysis Logs

General

Target

0a9f599cf8f8b97b6cc4c2788c2335e4.exe
Size

124KB
MD5

0a9f599cf8f8b97b6cc4c2788c2335e4
SHA1

a02343db280b4e3ab3fa8409957d515338b1811d
SHA256

57b00af123386e3b7ec1ad16d1452d96005ee65eb0ad40425a085edc5f443973
SHA512

746d0385275a5dba2bdd50f6d59c9adb77d7e1050e6632e3cba47a6baff5089e6fa38e2bd820d908b5c88e233fab6b99002d8d6d18b2df4b4253554d010bdc8b
SSDEEP

3072:3OLZ8dXeVRVT0fRrcmBcB9FpHkYDKf6yX6OIZ:3wZcXeVfIZ/cxOYDKSi6JZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2928	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3032	2928	0a9f599cf8f8b97b6cc4c2788c2335e4.exe	28
PID 2928 wrote to memory of 3032	2928	0a9f599cf8f8b97b6cc4c2788c2335e4.exe	28
PID 2928 wrote to memory of 3032	2928	0a9f599cf8f8b97b6cc4c2788c2335e4.exe	28
PID 2928 wrote to memory of 3032	2928	0a9f599cf8f8b97b6cc4c2788c2335e4.exe	28

C:\Users\Admin\AppData\Local\Temp\0a9f599cf8f8b97b6cc4c2788c2335e4.exe
"C:\Users\Admin\AppData\Local\Temp\0a9f599cf8f8b97b6cc4c2788c2335e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 144
  2⤵
  - Program crash
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download