75eb4221c5e05745d53794f1daae16084fc41666422ba26300aaf541622799d4 | Triage

Analysis

max time kernel
142s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:09

Sharing

Report Analysis Logs

General

Target

1d30ad94980d763353f9d329b119c683.exe
Size

814KB
MD5

1d30ad94980d763353f9d329b119c683
SHA1

3b6bab5e7a0558a24dd27608dbc27f4707fe0bd7
SHA256

75eb4221c5e05745d53794f1daae16084fc41666422ba26300aaf541622799d4
SHA512

af8382d700d894c7e132763045fbc11cff62f1c753c060c01a84085f1b05927066c8e358bb8fa423459404fa8df7d3c8fe0b33e25ad44905dbd97ad89c32f6f4
SSDEEP

24576:q7A/jSOJad323/52hx/hpHMvu71kcz24PXKrp:q7A/j1ad32v5Y+Sl1ad

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	2016	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1716	2016	1d30ad94980d763353f9d329b119c683.exe	28
PID 2016 wrote to memory of 1716	2016	1d30ad94980d763353f9d329b119c683.exe	28
PID 2016 wrote to memory of 1716	2016	1d30ad94980d763353f9d329b119c683.exe	28
PID 2016 wrote to memory of 1716	2016	1d30ad94980d763353f9d329b119c683.exe	28

C:\Users\Admin\AppData\Local\Temp\1d30ad94980d763353f9d329b119c683.exe
"C:\Users\Admin\AppData\Local\Temp\1d30ad94980d763353f9d329b119c683.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 92
  2⤵
  - Program crash
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2016-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download