63e2c4539a785469479023bcdc0c89924e2cda8338388bd47fddb7250a3814f9 | Triage

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:46

Sharing

Report Analysis Logs

General

Target

0c97e9fc329da3d376580ed029163668.exe
Size

178KB
MD5

0c97e9fc329da3d376580ed029163668
SHA1

363a33a6ad127a9cb686cd397e20f9b3b81f41ba
SHA256

63e2c4539a785469479023bcdc0c89924e2cda8338388bd47fddb7250a3814f9
SHA512

345df06e259ce233bd7893565d3c385b0041b1eeb322c9a14ab316c5c119755d5b94b3d290e47d9e328c31e60ae1257b11310e33d8473f2b62215060e5587428
SSDEEP

3072:P8v6xMdc3Cpw5RCpw5DKf3eKf3Xa3zNCEd:k6xMdVw5Kw5DeOeaDIEd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1708	1620	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1708	1620	0c97e9fc329da3d376580ed029163668.exe	15
PID 1620 wrote to memory of 1708	1620	0c97e9fc329da3d376580ed029163668.exe	15
PID 1620 wrote to memory of 1708	1620	0c97e9fc329da3d376580ed029163668.exe	15
PID 1620 wrote to memory of 1708	1620	0c97e9fc329da3d376580ed029163668.exe	15

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 88
1⤵
- Program crash
PID:1708

C:\Users\Admin\AppData\Local\Temp\0c97e9fc329da3d376580ed029163668.exe
"C:\Users\Admin\AppData\Local\Temp\0c97e9fc329da3d376580ed029163668.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000000400000-0x0000000000410200-memory.dmp

Filesize
64KB

Download
memory/1620-1-0x0000000000400000-0x0000000000410200-memory.dmp

Filesize
64KB

Download