f9d82fcc0c6499d0466bce9eb13727c7912feef3861957e05c53ee9c2646c9fc | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:04

Sharing

Report Analysis Logs

General

Target

196a5c384fbc3c3d326b2eadc2061318.exe
Size

44KB
MD5

196a5c384fbc3c3d326b2eadc2061318
SHA1

005566d925d1271d5f1df700bf63b985cf50777d
SHA256

f9d82fcc0c6499d0466bce9eb13727c7912feef3861957e05c53ee9c2646c9fc
SHA512

de355e3dfd3f90d810800c086b4c1c1a8124030c7d8548fb9e9ac3db1f6e42aaa9189c8f9b4ba9cdd523aa18af7e7803c4e36719ca426178697fbeeb6ef8b0b7
SSDEEP

768:+PUAbOeEJgWOTzGjWsULa/HZ7okrVv8Fe8tZ/aCv/qyKwrp:UUAbqbULYhVUk1Y

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
616	2988	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 616	2988	196a5c384fbc3c3d326b2eadc2061318.exe	29
PID 2988 wrote to memory of 616	2988	196a5c384fbc3c3d326b2eadc2061318.exe	29
PID 2988 wrote to memory of 616	2988	196a5c384fbc3c3d326b2eadc2061318.exe	29
PID 2988 wrote to memory of 616	2988	196a5c384fbc3c3d326b2eadc2061318.exe	29

C:\Users\Admin\AppData\Local\Temp\196a5c384fbc3c3d326b2eadc2061318.exe
"C:\Users\Admin\AppData\Local\Temp\196a5c384fbc3c3d326b2eadc2061318.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 544
  2⤵
  - Program crash
  PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x0000000000030000-0x0000000000042000-memory.dmp

Filesize
72KB

Download
memory/2988-1-0x0000000074E60000-0x000000007554E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-2-0x0000000074E60000-0x000000007554E000-memory.dmp

Filesize
6.9MB

Download