738b52a84a78798e9720630d10bdd4135837cdf38bc3a3ef11b9e15ece44eabe | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:51

Sharing

Report Analysis Logs

General

Target

27130eaae170dfa0e981a5a064136284.exe
Size

56KB
MD5

27130eaae170dfa0e981a5a064136284
SHA1

02355bd4c8bb3f98c28d249eef77b68f8f568de9
SHA256

738b52a84a78798e9720630d10bdd4135837cdf38bc3a3ef11b9e15ece44eabe
SHA512

e1df390ec7ee0ec620aa670550bf95d3970abe24fd76fb1a0615125dbdf73eb975e5c2fa5d43511fc17e6c57a7c7a011bee91cb60e946eb4ff2e0d261a8efb00
SSDEEP

768:F75EC6O5EnWHhL+0ikw/T6JUkEtRle/nNQas:FyfoCUidkw2YtRWnNQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1304	2040	27130eaae170dfa0e981a5a064136284.exe	28
PID 2040 wrote to memory of 1304	2040	27130eaae170dfa0e981a5a064136284.exe	28
PID 2040 wrote to memory of 1304	2040	27130eaae170dfa0e981a5a064136284.exe	28
PID 2040 wrote to memory of 1304	2040	27130eaae170dfa0e981a5a064136284.exe	28

C:\Users\Admin\AppData\Local\Temp\27130eaae170dfa0e981a5a064136284.exe
"C:\Users\Admin\AppData\Local\Temp\27130eaae170dfa0e981a5a064136284.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 176
  2⤵
  - Program crash
  PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads