c1bc5eeda32f56653f206f10bdcd04d30d171f9a85252660f788de2c49bb39fe | Triage

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 00:05

Sharing

Report Analysis Logs

General

Target

1b9e07c4ad51515c817a20e1eefa592a.exe
Size

1.0MB
MD5

1b9e07c4ad51515c817a20e1eefa592a
SHA1

75dfb24cd0467ddc5ea6211307931f1affbc2ec7
SHA256

c1bc5eeda32f56653f206f10bdcd04d30d171f9a85252660f788de2c49bb39fe
SHA512

1603f7c8c939431069db4089f86877c2afde10792c7655f0741e1042ddda6c5841573aeb630fd8bbd3827d0ec6d0b2e89d0e7c1b2d6938bb45e5be7451d3762a
SSDEEP

24576:JuUl8B5nw8yZS12kn6Z5v3NPuiFgsYRXdQn:IRB5nm0nK5vVLFgsodY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2796	2448	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2796	2448	1b9e07c4ad51515c817a20e1eefa592a.exe	16
PID 2448 wrote to memory of 2796	2448	1b9e07c4ad51515c817a20e1eefa592a.exe	16
PID 2448 wrote to memory of 2796	2448	1b9e07c4ad51515c817a20e1eefa592a.exe	16
PID 2448 wrote to memory of 2796	2448	1b9e07c4ad51515c817a20e1eefa592a.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 88
1⤵
- Program crash
PID:2796

C:\Users\Admin\AppData\Local\Temp\1b9e07c4ad51515c817a20e1eefa592a.exe
"C:\Users\Admin\AppData\Local\Temp\1b9e07c4ad51515c817a20e1eefa592a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads