e0ee648adbd4a6469c9322a770e678a0a7ba4d8deaa3ab6bea21970b7b6eb883 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:56

Sharing

Report Analysis Logs

General

Target

18dc20008ede1eb578e478fcdb36ca51.exe
Size

76KB
MD5

18dc20008ede1eb578e478fcdb36ca51
SHA1

d23b2321ad9fb6cb61cc009a974cdf1bb0199c69
SHA256

e0ee648adbd4a6469c9322a770e678a0a7ba4d8deaa3ab6bea21970b7b6eb883
SHA512

a34afe842ff3833a8d0e08ef643658e649148ccb03e1e95d1fcc431f3c747cd0823772698110e10f5e1db5773ee0e95462c68ff5d5c9837465fa351eeed8b103
SSDEEP

1536:FfdsuZphXgLPkagiDAnEeKe9sV48Ik2WF68pkd:F6uZv+MnEd9V48E+Gd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1364	1960	WerFault.exe	1

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1960	18dc20008ede1eb578e478fcdb36ca51.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1364	1960	18dc20008ede1eb578e478fcdb36ca51.exe	16
PID 1960 wrote to memory of 1364	1960	18dc20008ede1eb578e478fcdb36ca51.exe	16
PID 1960 wrote to memory of 1364	1960	18dc20008ede1eb578e478fcdb36ca51.exe	16
PID 1960 wrote to memory of 1364	1960	18dc20008ede1eb578e478fcdb36ca51.exe	16

C:\Users\Admin\AppData\Local\Temp\18dc20008ede1eb578e478fcdb36ca51.exe
"C:\Users\Admin\AppData\Local\Temp\18dc20008ede1eb578e478fcdb36ca51.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 172
  2⤵
  - Program crash
  PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads