d78a24aafd20b93ffd660517f48630528fcd0a1fe1cdc0571ea2dd9d3e445cbc | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:18

Sharing

Report Analysis Logs

General

Target

1067fc02b3168c44770283a33f65bca1.exe
Size

862KB
MD5

1067fc02b3168c44770283a33f65bca1
SHA1

5425f747b994de841856b57ab8bcfb288673bba1
SHA256

d78a24aafd20b93ffd660517f48630528fcd0a1fe1cdc0571ea2dd9d3e445cbc
SHA512

e76d7cccf637e9ffd7af9b6aa5b9977b49512c371deeb5e76873fab7b6fcd9b339c85063dae157469d3f1ee3f3ffb19363770d18d8675dc2064924eea6c45aa7
SSDEEP

24576:JkAJeTDwja2m53QtMOtsbReu+O9TZ3fKhcFRx+Q8sD7Eef:NJubH7TZvuMf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	2512	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1520	2512	1067fc02b3168c44770283a33f65bca1.exe	16
PID 2512 wrote to memory of 1520	2512	1067fc02b3168c44770283a33f65bca1.exe	16
PID 2512 wrote to memory of 1520	2512	1067fc02b3168c44770283a33f65bca1.exe	16
PID 2512 wrote to memory of 1520	2512	1067fc02b3168c44770283a33f65bca1.exe	16

C:\Users\Admin\AppData\Local\Temp\1067fc02b3168c44770283a33f65bca1.exe
"C:\Users\Admin\AppData\Local\Temp\1067fc02b3168c44770283a33f65bca1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 168
  2⤵
  - Program crash
  PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x00000000008D0000-0x0000000000989000-memory.dmp

Filesize
740KB

Download
memory/2512-1-0x00000000008D0000-0x0000000000989000-memory.dmp

Filesize
740KB

Download