e8fc2351cc17abcd2c3934cc62ba8ea1222a2450bed9e51a94127fa60f0ee777 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 07:14

Sharing

Report Analysis Logs

General

Target

0e0a0ced848cfe55d3e6676248024b77.exe
Size

28KB
MD5

0e0a0ced848cfe55d3e6676248024b77
SHA1

17f608348db4d0c909de4c20e4f5b237cb01d5c5
SHA256

e8fc2351cc17abcd2c3934cc62ba8ea1222a2450bed9e51a94127fa60f0ee777
SHA512

deb2e5d650af05f90fd7ed0edc2860b90f1427dda82c0ee65efcc03a2b201a029fceb8125b8d2458e2aa94dcd1e9fa46fd21a3d364a80d99885c403bc4cfb14c
SSDEEP

6:idqgHVg3F+X32mnWFySXpduZg6ytgdAZ1CLlAEW/:e31GSGmoXpduZ9laZ8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	1700	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2364	1700	0e0a0ced848cfe55d3e6676248024b77.exe	28
PID 1700 wrote to memory of 2364	1700	0e0a0ced848cfe55d3e6676248024b77.exe	28
PID 1700 wrote to memory of 2364	1700	0e0a0ced848cfe55d3e6676248024b77.exe	28
PID 1700 wrote to memory of 2364	1700	0e0a0ced848cfe55d3e6676248024b77.exe	28

C:\Users\Admin\AppData\Local\Temp\0e0a0ced848cfe55d3e6676248024b77.exe
"C:\Users\Admin\AppData\Local\Temp\0e0a0ced848cfe55d3e6676248024b77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 36
  2⤵
  - Program crash
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads