e73d6ebc0e4196165856e4d2ed4978fb458d7959dcb126b0a3c8c17ef195b345 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 02:47

Sharing

Report Analysis Logs

General

Target

00e759c2320e4aa24cc8287441bce04f.exe
Size

16KB
MD5

00e759c2320e4aa24cc8287441bce04f
SHA1

8610ddb2bbb8542152c6d6fcccf437d2a5ff0c35
SHA256

e73d6ebc0e4196165856e4d2ed4978fb458d7959dcb126b0a3c8c17ef195b345
SHA512

ec9ff171d51a21387ec2ab9dc0bc6b47ab41327ae883af0805872a0d885e47a4c79944ce27c82c678b8654cabdb08d32f34a90f62c45fe2b50b0266a2cc031aa
SSDEEP

384:Iy76FphlmxSp07k0LWThh7YEZQq0XBlta70DypPB681:WPV07rIvUPRfa7y2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2240	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2264	2240	00e759c2320e4aa24cc8287441bce04f.exe	16
PID 2240 wrote to memory of 2264	2240	00e759c2320e4aa24cc8287441bce04f.exe	16
PID 2240 wrote to memory of 2264	2240	00e759c2320e4aa24cc8287441bce04f.exe	16
PID 2240 wrote to memory of 2264	2240	00e759c2320e4aa24cc8287441bce04f.exe	16

C:\Users\Admin\AppData\Local\Temp\00e759c2320e4aa24cc8287441bce04f.exe
"C:\Users\Admin\AppData\Local\Temp\00e759c2320e4aa24cc8287441bce04f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 36
  2⤵
  - Program crash
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download