c6449898fa34effa89bde70f9319c27c9410a000b0588a9a884017a17d6af1e7 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:59

Sharing

Report Analysis Logs

General

Target

1c95ff37edef96994372fd8810e2de52.exe
Size

897B
MD5

1c95ff37edef96994372fd8810e2de52
SHA1

84bd4ee1deb89e3d33865304ebbb5ffbaf563de3
SHA256

c6449898fa34effa89bde70f9319c27c9410a000b0588a9a884017a17d6af1e7
SHA512

f807140417b4e322e554353c13b354cef3e79a0ae0b6ff7548857e9f7da89dfc2328c9f0866824e9d298fc89d8132eaa2319e574f1c1b5c24babf2e3f501d60f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	3068	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2208	3068	1c95ff37edef96994372fd8810e2de52.exe	28
PID 3068 wrote to memory of 2208	3068	1c95ff37edef96994372fd8810e2de52.exe	28
PID 3068 wrote to memory of 2208	3068	1c95ff37edef96994372fd8810e2de52.exe	28
PID 3068 wrote to memory of 2208	3068	1c95ff37edef96994372fd8810e2de52.exe	28

C:\Users\Admin\AppData\Local\Temp\1c95ff37edef96994372fd8810e2de52.exe
"C:\Users\Admin\AppData\Local\Temp\1c95ff37edef96994372fd8810e2de52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 36
  2⤵
  - Program crash
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads