19fcbe2d55fbce3db47759a055a3d839517fca4606153adacf90ce4ac7426013 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:05

Sharing

Report Analysis Logs

General

Target

13ce4308e5801e927f605246ffc6a82d.exe
Size

115KB
MD5

13ce4308e5801e927f605246ffc6a82d
SHA1

9db670bb32792387107b57f423ffbbdc1fe569e3
SHA256

19fcbe2d55fbce3db47759a055a3d839517fca4606153adacf90ce4ac7426013
SHA512

e374bee58629aae960fc3577dd693bef19e9d5f8241060ae6454e8e1bc934427dbea891d155432fe421efb44337ea4a04d846aafbdf5fc9e1cbf1e0db7b33895
SSDEEP

3072:4r6rXrzLaTFd9tnRADh4wQbq0VMstftQIjRuBoMiy:C87zLaxrSm3XduBd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	2656	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2360	2656	13ce4308e5801e927f605246ffc6a82d.exe	28
PID 2656 wrote to memory of 2360	2656	13ce4308e5801e927f605246ffc6a82d.exe	28
PID 2656 wrote to memory of 2360	2656	13ce4308e5801e927f605246ffc6a82d.exe	28
PID 2656 wrote to memory of 2360	2656	13ce4308e5801e927f605246ffc6a82d.exe	28

C:\Users\Admin\AppData\Local\Temp\13ce4308e5801e927f605246ffc6a82d.exe
"C:\Users\Admin\AppData\Local\Temp\13ce4308e5801e927f605246ffc6a82d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 236
  2⤵
  - Program crash
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download