e9bf6fbc9f787beefca0da530b935de9a0d7a1520f2774fa48b86f008658db2f | Triage

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0dbce5a93241216e2026d050844829d0.exe
Size

37KB
MD5

0dbce5a93241216e2026d050844829d0
SHA1

361489144cead81e0acd4b5569a46e1f23954d4a
SHA256

e9bf6fbc9f787beefca0da530b935de9a0d7a1520f2774fa48b86f008658db2f
SHA512

2dc81e3971f7325e06283d30a3b2175ab63ea3a681bfe89e157232668e51d5b01631f29eefdc00f2b12eaa84848803c8f7a2a428ddafa049d70108af077e7330
SSDEEP

768:uiIH0TqcDxN6ckrSQCMOhCBOmWbHv2UtRhx982JEo1JP:oOqWQ8hjt/v5Eo1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	2012	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2940	2012	0dbce5a93241216e2026d050844829d0.exe	28
PID 2012 wrote to memory of 2940	2012	0dbce5a93241216e2026d050844829d0.exe	28
PID 2012 wrote to memory of 2940	2012	0dbce5a93241216e2026d050844829d0.exe	28
PID 2012 wrote to memory of 2940	2012	0dbce5a93241216e2026d050844829d0.exe	28

C:\Users\Admin\AppData\Local\Temp\0dbce5a93241216e2026d050844829d0.exe
"C:\Users\Admin\AppData\Local\Temp\0dbce5a93241216e2026d050844829d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 963840
  2⤵
  - Program crash
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2012-1-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download