7560eb6b30a9efdbeed3249ae09bcc8ead68f22eae9f9d02500af5a7dd53bbd8 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:34

Sharing

Report Analysis Logs

General

Target

0f231f6501f31e69fc1cd69fac472ef2.exe
Size

270KB
MD5

0f231f6501f31e69fc1cd69fac472ef2
SHA1

15b4e92a7ce5547bcb0b470caea9471f0244c8e2
SHA256

7560eb6b30a9efdbeed3249ae09bcc8ead68f22eae9f9d02500af5a7dd53bbd8
SHA512

ce20b9419f758185d9b653bd01b7efb06354117b2f930bc36a0a017e69770decc3f6d370a66fe835170a4a4fab2c53820e88ab1d76eede97a48f276049485827
SSDEEP

6144:I2p2bNmIuIxEQDd/AnY2PU5REZdqqAdM0d:I2pyN5x3Dd/AnXPU5REFAMy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2056	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2508	2056	0f231f6501f31e69fc1cd69fac472ef2.exe	28
PID 2056 wrote to memory of 2508	2056	0f231f6501f31e69fc1cd69fac472ef2.exe	28
PID 2056 wrote to memory of 2508	2056	0f231f6501f31e69fc1cd69fac472ef2.exe	28
PID 2056 wrote to memory of 2508	2056	0f231f6501f31e69fc1cd69fac472ef2.exe	28

C:\Users\Admin\AppData\Local\Temp\0f231f6501f31e69fc1cd69fac472ef2.exe
"C:\Users\Admin\AppData\Local\Temp\0f231f6501f31e69fc1cd69fac472ef2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 280
  2⤵
  - Program crash
  PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads