7613914b6dbabff0f4d2d183da4a2a3e8de1bcfe4625010fc37560f3547bb57a | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:55

Sharing

Report Analysis Logs

General

Target

13535ed352783daff5aadf844aeedda4.exe
Size

115KB
MD5

13535ed352783daff5aadf844aeedda4
SHA1

50cf6c893150b9eb9479374bbbdad14d123b8ec2
SHA256

7613914b6dbabff0f4d2d183da4a2a3e8de1bcfe4625010fc37560f3547bb57a
SHA512

a24276f808b99fc291dad7af3f4ac039fe780397e7c7148a980cbaa2175de3aef114529833af624c72b976b0854e329c822f30e00e598ec545b7d17203370bed
SSDEEP

3072:rvkGO9TMGNG0WycxnvdwOxQZbGL6msFhx2DmuA2:TkGmMGky+iO+GCh0DTz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2764	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2664	2764	13535ed352783daff5aadf844aeedda4.exe	28
PID 2764 wrote to memory of 2664	2764	13535ed352783daff5aadf844aeedda4.exe	28
PID 2764 wrote to memory of 2664	2764	13535ed352783daff5aadf844aeedda4.exe	28
PID 2764 wrote to memory of 2664	2764	13535ed352783daff5aadf844aeedda4.exe	28

C:\Users\Admin\AppData\Local\Temp\13535ed352783daff5aadf844aeedda4.exe
"C:\Users\Admin\AppData\Local\Temp\13535ed352783daff5aadf844aeedda4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 116
  2⤵
  - Program crash
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads