3de240e821405584f71a504614aef524867d8bd7e3ff41f14a2b1d952d18d423 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:09

Sharing

Report Analysis Logs

General

Target

244fc4fcb3e3b2c5804e4f657c926a77.exe
Size

20KB
MD5

244fc4fcb3e3b2c5804e4f657c926a77
SHA1

c212e8027860dfccb96e00dd348195ac9987c040
SHA256

3de240e821405584f71a504614aef524867d8bd7e3ff41f14a2b1d952d18d423
SHA512

00676f03977a2f2c655bb5bf8c0489a3d60b37045026b6437e4e4ff39549d399e6ddf7af1a244e635f3c88dae3a35d7735dd971125fbe19fc91d117e0a8246d9
SSDEEP

6:iz3SsEu9/YMS2eApxAII/aABORIBvuJKQmQ:wT9/YMSW/AlaUORIBvuJ5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2888	2864	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2888	2864	244fc4fcb3e3b2c5804e4f657c926a77.exe	16
PID 2864 wrote to memory of 2888	2864	244fc4fcb3e3b2c5804e4f657c926a77.exe	16
PID 2864 wrote to memory of 2888	2864	244fc4fcb3e3b2c5804e4f657c926a77.exe	16
PID 2864 wrote to memory of 2888	2864	244fc4fcb3e3b2c5804e4f657c926a77.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 88
1⤵
- Program crash
PID:2888

C:\Users\Admin\AppData\Local\Temp\244fc4fcb3e3b2c5804e4f657c926a77.exe
"C:\Users\Admin\AppData\Local\Temp\244fc4fcb3e3b2c5804e4f657c926a77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download