11de5592f66b7fd220904b8992963ed424cf3b3216da09c15c091e2f86a1cfed | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 14:56

Sharing

Report Analysis Logs

General

Target

275b37393a710ae52190d85818af0168.exe
Size

345KB
MD5

275b37393a710ae52190d85818af0168
SHA1

cca15bc1d64435e0f7570e0272dd34fac0e45d77
SHA256

11de5592f66b7fd220904b8992963ed424cf3b3216da09c15c091e2f86a1cfed
SHA512

c46f18a5c457308f57aed7979d8786d4b28c6bd848c63825b534390e08fb76d2d42cd8720c4bfd5dccfe07e0645a10dd5e652345e3111a9ab50a00e36c0bd977
SSDEEP

6144:Ubp2x30RO0jeGlWW1GsxKCADBwKqg9+XuYkD:ueGlWmoeKFvJD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	3044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2236	3044	275b37393a710ae52190d85818af0168.exe	29
PID 3044 wrote to memory of 2236	3044	275b37393a710ae52190d85818af0168.exe	29
PID 3044 wrote to memory of 2236	3044	275b37393a710ae52190d85818af0168.exe	29
PID 3044 wrote to memory of 2236	3044	275b37393a710ae52190d85818af0168.exe	29

C:\Users\Admin\AppData\Local\Temp\275b37393a710ae52190d85818af0168.exe
"C:\Users\Admin\AppData\Local\Temp\275b37393a710ae52190d85818af0168.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 160
  2⤵
  - Program crash
  PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000000D20000-0x0000000000D4C000-memory.dmp

Filesize
176KB

Download
memory/3044-1-0x0000000000D20000-0x0000000000D4C000-memory.dmp

Filesize
176KB

Download