ca653364634d2c909e132869abb2f7fda324e2607d4f88f37164256efafbce6f | Triage

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:01

Sharing

Report Analysis Logs

General

Target

0d5c0f36d626e886e78400435981afc6.exe
Size

323KB
MD5

0d5c0f36d626e886e78400435981afc6
SHA1

3e3b40df16f111bfc61765648981e16b63360b3a
SHA256

ca653364634d2c909e132869abb2f7fda324e2607d4f88f37164256efafbce6f
SHA512

74e08333c233d928db8cebc705b09545a5466b863fc82151e5c42558d84b31e58a0e2bd9b578f41ef8afac1efc6b7e5414722a3ef37bc2a310b672815e44e666
SSDEEP

6144:11IuZBF9eWdPlljd3rKzwN8Jlljd3njPX9ZAk3fs:11BnGWxjpKXjtjP9Zt0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2084	2224	0d5c0f36d626e886e78400435981afc6.exe	28
PID 2224 wrote to memory of 2084	2224	0d5c0f36d626e886e78400435981afc6.exe	28
PID 2224 wrote to memory of 2084	2224	0d5c0f36d626e886e78400435981afc6.exe	28
PID 2224 wrote to memory of 2084	2224	0d5c0f36d626e886e78400435981afc6.exe	28

C:\Users\Admin\AppData\Local\Temp\0d5c0f36d626e886e78400435981afc6.exe
"C:\Users\Admin\AppData\Local\Temp\0d5c0f36d626e886e78400435981afc6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 140
  2⤵
  - Program crash
  PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download