241fbb4bc22254804436fff866c2dba6ba3f8ef33552c1473c392ade0f8bc42f | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 01:05

Sharing

Report Analysis Logs

General

Target

1f24004c37a434f7ff5960f60d075774.exe
Size

467KB
MD5

1f24004c37a434f7ff5960f60d075774
SHA1

2ca950fe8ec9b68ce4494043a653a354a8bafae4
SHA256

241fbb4bc22254804436fff866c2dba6ba3f8ef33552c1473c392ade0f8bc42f
SHA512

1e090bc7fca50ef7b919e4b0239eff0194f9a37d90b794d7534fa88121b1e10e28fa6cffed4142f87a42f1746396f1a9c6f036df87fee86db65428247c91adc2
SSDEEP

6144:aoj8M6lWK2+ER0u+GIIIIIIIhIIIIIIIIIIIIIIIUYWJ6K:aojZJVm5YST

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	1440	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1204	1440	1f24004c37a434f7ff5960f60d075774.exe	28
PID 1440 wrote to memory of 1204	1440	1f24004c37a434f7ff5960f60d075774.exe	28
PID 1440 wrote to memory of 1204	1440	1f24004c37a434f7ff5960f60d075774.exe	28
PID 1440 wrote to memory of 1204	1440	1f24004c37a434f7ff5960f60d075774.exe	28

C:\Users\Admin\AppData\Local\Temp\1f24004c37a434f7ff5960f60d075774.exe
"C:\Users\Admin\AppData\Local\Temp\1f24004c37a434f7ff5960f60d075774.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 36
  2⤵
  - Program crash
  PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads