34e3835f381c24261cc39e8dbf36a8c5e72278b120b9bd34fb9c729bbf5bd788 | Triage

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:58

Sharing

Report Analysis Logs

General

Target

01666ea195ab254f5e0cd3df6dcd79fc.exe
Size

877KB
MD5

01666ea195ab254f5e0cd3df6dcd79fc
SHA1

84e246891eee46b8278acc2cdd3ea53413eb5ff6
SHA256

34e3835f381c24261cc39e8dbf36a8c5e72278b120b9bd34fb9c729bbf5bd788
SHA512

60e2f30ac3317b16dd581b7c09829126e256da0359ba56f7dc634e441cd29d8c09271ca40f9b774b2b7c5829fa7ae21124bf98e2421d8680b59cb6806b81249a
SSDEEP

24576:JoSGOwibA5yVypcCtFF0s6Z6oxWO4siQrGR0S3v:JoSGURVypBtN6Zx5rGR3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	2672	WerFault.exe	13

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2900	2672	01666ea195ab254f5e0cd3df6dcd79fc.exe	28
PID 2672 wrote to memory of 2900	2672	01666ea195ab254f5e0cd3df6dcd79fc.exe	28
PID 2672 wrote to memory of 2900	2672	01666ea195ab254f5e0cd3df6dcd79fc.exe	28
PID 2672 wrote to memory of 2900	2672	01666ea195ab254f5e0cd3df6dcd79fc.exe	28
PID 2672 wrote to memory of 2900	2672	01666ea195ab254f5e0cd3df6dcd79fc.exe	28
PID 2672 wrote to memory of 2900	2672	01666ea195ab254f5e0cd3df6dcd79fc.exe	28
PID 2672 wrote to memory of 2900	2672	01666ea195ab254f5e0cd3df6dcd79fc.exe	28

C:\Users\Admin\AppData\Local\Temp\01666ea195ab254f5e0cd3df6dcd79fc.exe
"C:\Users\Admin\AppData\Local\Temp\01666ea195ab254f5e0cd3df6dcd79fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 268
  2⤵
  - Program crash
  PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-0-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download