5970c0d03b0a4c4beaf7e9c0a2eaed8f064bb9d068a7e556f20504b365318273 | Triage

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:12

Sharing

Report Analysis Logs

General

Target

20d822ab9b6bdb4aafec2bc2b28e6df6.exe
Size

260KB
MD5

20d822ab9b6bdb4aafec2bc2b28e6df6
SHA1

da7bd60579cec997a8f4ec585b788653c7e8edab
SHA256

5970c0d03b0a4c4beaf7e9c0a2eaed8f064bb9d068a7e556f20504b365318273
SHA512

8a334492c6269174dfcb30e451800808e028b97a16801deecb5e4d49e99a924e126568536a018d663e7e0ee90988a15a6b51780f11388d5a11247450f6ec3359
SSDEEP

6144:tytFKHMDoUwJcvg7MygFCoCRv+/QjQl2xRcOp:0SsDsaCoCRm/QjQwxRcm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	1860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2200	1860	20d822ab9b6bdb4aafec2bc2b28e6df6.exe	29
PID 1860 wrote to memory of 2200	1860	20d822ab9b6bdb4aafec2bc2b28e6df6.exe	29
PID 1860 wrote to memory of 2200	1860	20d822ab9b6bdb4aafec2bc2b28e6df6.exe	29
PID 1860 wrote to memory of 2200	1860	20d822ab9b6bdb4aafec2bc2b28e6df6.exe	29

C:\Users\Admin\AppData\Local\Temp\20d822ab9b6bdb4aafec2bc2b28e6df6.exe
"C:\Users\Admin\AppData\Local\Temp\20d822ab9b6bdb4aafec2bc2b28e6df6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 48
  2⤵
  - Program crash
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download