7912c412dbd5766df4364c6b0c8131ad360b67e68aaad376dfd76625b71a3e6d | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:13

Sharing

Report Analysis Logs

General

Target

1f9c28b92df8cdcb416fd3b68120440b.exe
Size

68KB
MD5

1f9c28b92df8cdcb416fd3b68120440b
SHA1

0f299b85b7aa004cbc0a73bd050f297e025ae642
SHA256

7912c412dbd5766df4364c6b0c8131ad360b67e68aaad376dfd76625b71a3e6d
SHA512

09edd72350e58e353951ab5076caeca29a8faa3e976937c6a5b5612747b840d1740af206208741899c0f40f634237e98c1d20635e72fc6aa8ca03d1fe37a966a
SSDEEP

1536:4agFotbi68CUACfARwnMxmvRdwHbrLFd9Y:Kotbi7CRYpn/vRipd9Y

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	3020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3060	3020	1f9c28b92df8cdcb416fd3b68120440b.exe	28
PID 3020 wrote to memory of 3060	3020	1f9c28b92df8cdcb416fd3b68120440b.exe	28
PID 3020 wrote to memory of 3060	3020	1f9c28b92df8cdcb416fd3b68120440b.exe	28
PID 3020 wrote to memory of 3060	3020	1f9c28b92df8cdcb416fd3b68120440b.exe	28

C:\Users\Admin\AppData\Local\Temp\1f9c28b92df8cdcb416fd3b68120440b.exe
"C:\Users\Admin\AppData\Local\Temp\1f9c28b92df8cdcb416fd3b68120440b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 88
  2⤵
  - Program crash
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads