c26f20e3ebcbf7be8330b007b96bc1a7bdc6258f2c145d7bd86464cc0805e07b | Triage

Analysis

max time kernel
117s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:44

Sharing

Report Analysis Logs

General

Target

2a45c30f0ebe10db1a095e956fee0267.exe
Size

1.0MB
MD5

2a45c30f0ebe10db1a095e956fee0267
SHA1

81d71cbdf24eea55c1208cc0ed7493c588b38789
SHA256

c26f20e3ebcbf7be8330b007b96bc1a7bdc6258f2c145d7bd86464cc0805e07b
SHA512

14b6626f2e7409d3541c4dbceb2f905fda7304f846a4b1d8dafae8e6b5287c2e5981d90b977a8f559b40d873103956116572aad33ea2b6d98dc944bbc86c8b41
SSDEEP

24576:8OwgZwGplJ26nSKU7oPyzFWb3VaYpH9uy4aP:kgOSw6n0oP0I7pH9uy/P

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	2548	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2532	2548	2a45c30f0ebe10db1a095e956fee0267.exe	28
PID 2548 wrote to memory of 2532	2548	2a45c30f0ebe10db1a095e956fee0267.exe	28
PID 2548 wrote to memory of 2532	2548	2a45c30f0ebe10db1a095e956fee0267.exe	28
PID 2548 wrote to memory of 2532	2548	2a45c30f0ebe10db1a095e956fee0267.exe	28

C:\Users\Admin\AppData\Local\Temp\2a45c30f0ebe10db1a095e956fee0267.exe
"C:\Users\Admin\AppData\Local\Temp\2a45c30f0ebe10db1a095e956fee0267.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 88
  2⤵
  - Program crash
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads