7f7c8fadaa8701b3d083ccbbdb44334a18ca1ab29621bf6e7b1d4ce25b7a2f4d | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:09

Sharing

Report Analysis Logs

General

Target

1267ced957778fe56d9ed70768106b9b.exe
Size

27KB
MD5

1267ced957778fe56d9ed70768106b9b
SHA1

738bfb95dd9c516d163223396bafb561a7505eb5
SHA256

7f7c8fadaa8701b3d083ccbbdb44334a18ca1ab29621bf6e7b1d4ce25b7a2f4d
SHA512

8032cab11794029efdac61990028ee4337c69a149e377484f81399581ec1150b8402c1e2f8095cf71db17c2aa0c1cb8f50294d08cdde24b1afd007f0021e4eef
SSDEEP

768:1JkT8KyxQCKFSl0fRbSAb6xi77tZraJEHy2:rkTSpKFY0fh4i7pH1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	2372	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1372	2372	1267ced957778fe56d9ed70768106b9b.exe	17
PID 2372 wrote to memory of 1372	2372	1267ced957778fe56d9ed70768106b9b.exe	17
PID 2372 wrote to memory of 1372	2372	1267ced957778fe56d9ed70768106b9b.exe	17
PID 2372 wrote to memory of 1372	2372	1267ced957778fe56d9ed70768106b9b.exe	17

C:\Users\Admin\AppData\Local\Temp\1267ced957778fe56d9ed70768106b9b.exe
"C:\Users\Admin\AppData\Local\Temp\1267ced957778fe56d9ed70768106b9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 36
  2⤵
  - Program crash
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads