e702bf40726c1dd1721fad989755c5787f1eee44ac07175956db2ee48290c1e7 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:43

Sharing

Report Analysis Logs

General

Target

26817d7589d3defb38c688c7563ef2f7.exe
Size

579KB
MD5

26817d7589d3defb38c688c7563ef2f7
SHA1

674d004d15dc9d226922a604e73bf183ee39083d
SHA256

e702bf40726c1dd1721fad989755c5787f1eee44ac07175956db2ee48290c1e7
SHA512

8bcf766de5fa174de37d084ce19758c1da3b3c8dc8fa9c0c2df8637081b16bc36f1d52b675dc56e824089b288c942b08a30e56ae1aa211716a26c087f125d21f
SSDEEP

12288:zTldzg9X5XsjPefG8Bzjf0PpaimPER7wo:zPT0lBzwcimsxwo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2260	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2268	2260	26817d7589d3defb38c688c7563ef2f7.exe	16
PID 2260 wrote to memory of 2268	2260	26817d7589d3defb38c688c7563ef2f7.exe	16
PID 2260 wrote to memory of 2268	2260	26817d7589d3defb38c688c7563ef2f7.exe	16
PID 2260 wrote to memory of 2268	2260	26817d7589d3defb38c688c7563ef2f7.exe	16

C:\Users\Admin\AppData\Local\Temp\26817d7589d3defb38c688c7563ef2f7.exe
"C:\Users\Admin\AppData\Local\Temp\26817d7589d3defb38c688c7563ef2f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 36
  2⤵
  - Program crash
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads