2bcc052649fa6d21c72cbacd0f038437557cbde300226112459c7fb875b0b395 | Triage

Analysis

max time kernel
142s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 08:16

Sharing

Report Analysis Logs

General

Target

116cf8c610dde7a22c339f9a4150ccbd.exe
Size

55KB
MD5

116cf8c610dde7a22c339f9a4150ccbd
SHA1

b15cd18bbe735a1974bd262be94c124d59286e21
SHA256

2bcc052649fa6d21c72cbacd0f038437557cbde300226112459c7fb875b0b395
SHA512

172ee4924694789afde1b041460546ef7296025f44aa650fc1cde87c109d42641290181c1c411a4799a938c16ac0ce12f9220cf8673ead130cbab854460c7c8e
SSDEEP

1536:g4nglxc0qx9aSNTLYkj+PaQ9bqJKfCQ2LS:9glxc0qxLNT0kjtQ3fCS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	2000	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1920	2000	116cf8c610dde7a22c339f9a4150ccbd.exe	28
PID 2000 wrote to memory of 1920	2000	116cf8c610dde7a22c339f9a4150ccbd.exe	28
PID 2000 wrote to memory of 1920	2000	116cf8c610dde7a22c339f9a4150ccbd.exe	28
PID 2000 wrote to memory of 1920	2000	116cf8c610dde7a22c339f9a4150ccbd.exe	28

C:\Users\Admin\AppData\Local\Temp\116cf8c610dde7a22c339f9a4150ccbd.exe
"C:\Users\Admin\AppData\Local\Temp\116cf8c610dde7a22c339f9a4150ccbd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 140
  2⤵
  - Program crash
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2000-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download