f0105453c6a6171f688965e1c99766c48287d2e80712210593e44263b34b3d5e | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:09

Sharing

Report Analysis Logs

General

Target

048bf78f473f555917a4ffdd231ee25c.exe
Size

217KB
MD5

048bf78f473f555917a4ffdd231ee25c
SHA1

1426ab754c4fd0785d8cb5116021f66be01501f8
SHA256

f0105453c6a6171f688965e1c99766c48287d2e80712210593e44263b34b3d5e
SHA512

a47f3beeaeacf2fa5498101a738a326f24f569ca7c3bf5fa4d522f44f183debcdfe579a05a034c4f31314220eb05befa1d3e108fdba567cfec9ed1225c1d07be
SSDEEP

768:tIbIDF8w+yT0aT/uYQdnSxgOcgoDQ2nQCbYm:+bIx3T0aTmYJgOihnhkm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	1420	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2172	1420	048bf78f473f555917a4ffdd231ee25c.exe	28
PID 1420 wrote to memory of 2172	1420	048bf78f473f555917a4ffdd231ee25c.exe	28
PID 1420 wrote to memory of 2172	1420	048bf78f473f555917a4ffdd231ee25c.exe	28
PID 1420 wrote to memory of 2172	1420	048bf78f473f555917a4ffdd231ee25c.exe	28

C:\Users\Admin\AppData\Local\Temp\048bf78f473f555917a4ffdd231ee25c.exe
"C:\Users\Admin\AppData\Local\Temp\048bf78f473f555917a4ffdd231ee25c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 36
  2⤵
  - Program crash
  PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1420-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download