53f9fc5df32cbb3bb44873518a05f0d11a9e599bae57c5067f2434ef68875c75 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:12

Sharing

Report Analysis Logs

General

Target

20d5c6c67576eb723beb7504cbb53b4c.exe
Size

148KB
MD5

20d5c6c67576eb723beb7504cbb53b4c
SHA1

054445a6ddbd3bf24035ad059d98d55a20bf6e8e
SHA256

53f9fc5df32cbb3bb44873518a05f0d11a9e599bae57c5067f2434ef68875c75
SHA512

6711cbdeff358d617af4236329be1be3ddbf95c09e18dbfa5fa3da6ac30022c8abcf52ce968bffb6255225b34fc8262b9fe08f0467770a595a0620f373704fbe
SSDEEP

384:n3wIA7GjIyE6nnP9TDWsKAkk/fG8+lmQP+0JSfgyz:3wIA7QhtDUAdnemQVSfg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2168	2860	WerFault.exe	15

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2168	2860	20d5c6c67576eb723beb7504cbb53b4c.exe	28
PID 2860 wrote to memory of 2168	2860	20d5c6c67576eb723beb7504cbb53b4c.exe	28
PID 2860 wrote to memory of 2168	2860	20d5c6c67576eb723beb7504cbb53b4c.exe	28
PID 2860 wrote to memory of 2168	2860	20d5c6c67576eb723beb7504cbb53b4c.exe	28
PID 2860 wrote to memory of 2168	2860	20d5c6c67576eb723beb7504cbb53b4c.exe	28
PID 2860 wrote to memory of 2168	2860	20d5c6c67576eb723beb7504cbb53b4c.exe	28
PID 2860 wrote to memory of 2168	2860	20d5c6c67576eb723beb7504cbb53b4c.exe	28

C:\Users\Admin\AppData\Local\Temp\20d5c6c67576eb723beb7504cbb53b4c.exe
"C:\Users\Admin\AppData\Local\Temp\20d5c6c67576eb723beb7504cbb53b4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 320
  2⤵
  - Program crash
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2860-1-0x0000000000170000-0x0000000000195000-memory.dmp

Filesize
148KB

Download
memory/2860-2-0x0000000000170000-0x0000000000195000-memory.dmp

Filesize
148KB

Download