e4f70986919e8a5ec046117ba054a105c801af20940822af24df013912ae9394 | Triage

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:42

Sharing

Report Analysis Logs

General

Target

1809088babe459e1fce72e44f00592b9.exe
Size

39KB
MD5

1809088babe459e1fce72e44f00592b9
SHA1

6119a604b618368cfb8b96ef55ec245000c4d3be
SHA256

e4f70986919e8a5ec046117ba054a105c801af20940822af24df013912ae9394
SHA512

f250c9b7181032e3d6436a786b07d3077f34e4312d15d60ab77e48e75b6c1b31f2c13ff705a7c17ed5cdd545e07e8afb61d14bb848f5a71ff000a09c61c50c31
SSDEEP

192:6y9umQ8b+8LMvlNCOOIwF7eYNpJ2mfrtMNeT:CmQ8b+fpiFCYNpwytMNe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2248	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2408	2248	1809088babe459e1fce72e44f00592b9.exe	26
PID 2248 wrote to memory of 2408	2248	1809088babe459e1fce72e44f00592b9.exe	26
PID 2248 wrote to memory of 2408	2248	1809088babe459e1fce72e44f00592b9.exe	26
PID 2248 wrote to memory of 2408	2248	1809088babe459e1fce72e44f00592b9.exe	26

C:\Users\Admin\AppData\Local\Temp\1809088babe459e1fce72e44f00592b9.exe
"C:\Users\Admin\AppData\Local\Temp\1809088babe459e1fce72e44f00592b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 216
  2⤵
  - Program crash
  PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2248-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2248-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2248-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download