19f043aa966f13a29f9a860057fb2a290939f75115e9784989fcbe96ad9242cb | Triage

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:39

Sharing

Report Analysis Logs

General

Target

29f18d1d43889dc0b8b3fcfee682430d.exe
Size

132KB
MD5

29f18d1d43889dc0b8b3fcfee682430d
SHA1

61fe80e1d5a4225d7a83acd391f0a16cfe5a6dab
SHA256

19f043aa966f13a29f9a860057fb2a290939f75115e9784989fcbe96ad9242cb
SHA512

dc6fd15227089b167e4cce123e5f582c4985ae32688d5483845b45cc3cd8a08b78f8b9375ec64d443a88411f903792a232ebae544381986138b7d2d9c87305a1
SSDEEP

3072:ZVVOY64v7jkfam1CXDDjtFCZaOKYZfG3QZuGc6O:ZVQY5vEb2DDjtlOzfYMh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	2540	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1344	2540	29f18d1d43889dc0b8b3fcfee682430d.exe	28
PID 2540 wrote to memory of 1344	2540	29f18d1d43889dc0b8b3fcfee682430d.exe	28
PID 2540 wrote to memory of 1344	2540	29f18d1d43889dc0b8b3fcfee682430d.exe	28
PID 2540 wrote to memory of 1344	2540	29f18d1d43889dc0b8b3fcfee682430d.exe	28

C:\Users\Admin\AppData\Local\Temp\29f18d1d43889dc0b8b3fcfee682430d.exe
"C:\Users\Admin\AppData\Local\Temp\29f18d1d43889dc0b8b3fcfee682430d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 136
  2⤵
  - Program crash
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2540-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download