7910646b8b0a59bbe5960557550e32a3f6d7cf59320603656620d42628e722cd | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:12

Sharing

Report Analysis Logs

General

Target

0de3b7f1d7ddca95ea0e67230845d998.exe
Size

332KB
MD5

0de3b7f1d7ddca95ea0e67230845d998
SHA1

e92449ea044c391506559e8e29523e67d444bcac
SHA256

7910646b8b0a59bbe5960557550e32a3f6d7cf59320603656620d42628e722cd
SHA512

9f4291a62b8827cfc5af7434f939d3a7b854707e15a16e1739a2030aac5ebcaf07cc0070214ee4a1b70536a0cede408ac2428467665e53dc3f94594486e4d024
SSDEEP

6144:BP0aakN6Z1gq8oyGQlxDH/UH6amoMK3oy:BP3RspyGQlpsa6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2444	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2684	2444	0de3b7f1d7ddca95ea0e67230845d998.exe	28
PID 2444 wrote to memory of 2684	2444	0de3b7f1d7ddca95ea0e67230845d998.exe	28
PID 2444 wrote to memory of 2684	2444	0de3b7f1d7ddca95ea0e67230845d998.exe	28
PID 2444 wrote to memory of 2684	2444	0de3b7f1d7ddca95ea0e67230845d998.exe	28

C:\Users\Admin\AppData\Local\Temp\0de3b7f1d7ddca95ea0e67230845d998.exe
"C:\Users\Admin\AppData\Local\Temp\0de3b7f1d7ddca95ea0e67230845d998.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 36
  2⤵
  - Program crash
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads