48a87a69a8fb80bf53b0faa2907acaf06cef10739eb1c59a2460a7e7b8088890 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:57

Sharing

Report Analysis Logs

General

Target

0f3cef0bab085e427561b34ecb7335dd.exe
Size

129KB
MD5

0f3cef0bab085e427561b34ecb7335dd
SHA1

3f79894b85fbf7b955413f7d0e867302a1fa2a0d
SHA256

48a87a69a8fb80bf53b0faa2907acaf06cef10739eb1c59a2460a7e7b8088890
SHA512

849f5b6034b5801c9ed5cd912aea4b3158f7d1998314322b5c05217f2929886c564cbb765d3f3a4e39daa7146add551b01e48450c1418c86df972ae5064fd97f
SSDEEP

3072:N+QAoil417nHoAKBa/fmUeV19s6l4UnkI6SL24EEx:7AoEoHRkaGZ19PJ2z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	3020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3064	3020	0f3cef0bab085e427561b34ecb7335dd.exe	28
PID 3020 wrote to memory of 3064	3020	0f3cef0bab085e427561b34ecb7335dd.exe	28
PID 3020 wrote to memory of 3064	3020	0f3cef0bab085e427561b34ecb7335dd.exe	28
PID 3020 wrote to memory of 3064	3020	0f3cef0bab085e427561b34ecb7335dd.exe	28

C:\Users\Admin\AppData\Local\Temp\0f3cef0bab085e427561b34ecb7335dd.exe
"C:\Users\Admin\AppData\Local\Temp\0f3cef0bab085e427561b34ecb7335dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 36
  2⤵
  - Program crash
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download