507ca10bc530dc14bcd0374f37ac620e75294f156938fd904e27f1264d20e0d6 | Triage

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:32

Sharing

Report Analysis Logs

General

Target

00196592f237f21467080f0fb90810e0.exe
Size

123KB
MD5

00196592f237f21467080f0fb90810e0
SHA1

ab52b8f72124ad0831d5f507d14b652d0c165c56
SHA256

507ca10bc530dc14bcd0374f37ac620e75294f156938fd904e27f1264d20e0d6
SHA512

c5eda99a6d9c7aca7fc274cc55cf2d63c8e3d248ab1443d9a8e542e8c0ae6719cc1f0eb47a80d3b48a3772176ac2d9cb1da67dffa98a1e0fb348a593535645e0
SSDEEP

3072:9LTgAqP8uq9NNP1MtCzLwWqJFilCDCrNSjpQwT7i+R6:eAxXNat7CCDJmwXlo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2444	2656	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2444	2656	00196592f237f21467080f0fb90810e0.exe	16
PID 2656 wrote to memory of 2444	2656	00196592f237f21467080f0fb90810e0.exe	16
PID 2656 wrote to memory of 2444	2656	00196592f237f21467080f0fb90810e0.exe	16
PID 2656 wrote to memory of 2444	2656	00196592f237f21467080f0fb90810e0.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 36
1⤵
- Program crash
PID:2444

C:\Users\Admin\AppData\Local\Temp\00196592f237f21467080f0fb90810e0.exe
"C:\Users\Admin\AppData\Local\Temp\00196592f237f21467080f0fb90810e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download