e4ac384f217df32c0ae43f078110698b03f57c163f02445f24bcbd471a082db5 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:25

Sharing

Report Analysis Logs

General

Target

0ea10a2eaa7fc217b5b80367a1532229.exe
Size

904KB
MD5

0ea10a2eaa7fc217b5b80367a1532229
SHA1

61481e89366011a3796dcaf77bef2b1a1f03a7b1
SHA256

e4ac384f217df32c0ae43f078110698b03f57c163f02445f24bcbd471a082db5
SHA512

2ea3f007f62dc44cd86a0956b06a3c4fd74106fd68c7695f6d021924aca0f91f17c8c6d93cf32a8f55ddb97fba7fa30e75bb9e29a04309203e4091d05a5f2a1f
SSDEEP

3072:ft2cWtTBfVkfqM2SCAygRjlIqZoFzJcqyP:hWtTBdsqEPxjjoFzK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	2020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2172	2020	0ea10a2eaa7fc217b5b80367a1532229.exe	28
PID 2020 wrote to memory of 2172	2020	0ea10a2eaa7fc217b5b80367a1532229.exe	28
PID 2020 wrote to memory of 2172	2020	0ea10a2eaa7fc217b5b80367a1532229.exe	28
PID 2020 wrote to memory of 2172	2020	0ea10a2eaa7fc217b5b80367a1532229.exe	28

C:\Users\Admin\AppData\Local\Temp\0ea10a2eaa7fc217b5b80367a1532229.exe
"C:\Users\Admin\AppData\Local\Temp\0ea10a2eaa7fc217b5b80367a1532229.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 36
  2⤵
  - Program crash
  PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads