55f2abc6e1711dd73f790da5e7b95985d23ce407dfc1331f820c79ae578ece42 | Triage

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:43

Sharing

Report Analysis Logs

General

Target

2e0843a424f01bf9d3c33ccb4973289a.exe
Size

29KB
MD5

2e0843a424f01bf9d3c33ccb4973289a
SHA1

d31fa0950505106a2fd6e21f3511505c47c5ee4b
SHA256

55f2abc6e1711dd73f790da5e7b95985d23ce407dfc1331f820c79ae578ece42
SHA512

eb2b830f37b99a90de5ad5484dc188a6377426541e1c378978711c8703b2b542e7ad30888e9fb6ae7c778018c3747c8049b81eca454e2e2276116d803f1a12b6
SSDEEP

768:AkHtd5l/ija+1I2qOWqld+vlUA4bSHsoQTtUt:ActdrOXan/5Qy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2444	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2684	2444	2e0843a424f01bf9d3c33ccb4973289a.exe	28
PID 2444 wrote to memory of 2684	2444	2e0843a424f01bf9d3c33ccb4973289a.exe	28
PID 2444 wrote to memory of 2684	2444	2e0843a424f01bf9d3c33ccb4973289a.exe	28
PID 2444 wrote to memory of 2684	2444	2e0843a424f01bf9d3c33ccb4973289a.exe	28

C:\Users\Admin\AppData\Local\Temp\2e0843a424f01bf9d3c33ccb4973289a.exe
"C:\Users\Admin\AppData\Local\Temp\2e0843a424f01bf9d3c33ccb4973289a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 124
  2⤵
  - Program crash
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-0-0x0000000004000000-0x0000000004011000-memory.dmp

Filesize
68KB

Download