dc32709098456e6e1495af73988369363a4a73f2c3a98cb4cbb82f425bf86d3c | Triage

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:22

Sharing

Report Analysis Logs

General

Target

2cc82d63d41bde8c975f267e31015648.exe
Size

540KB
MD5

2cc82d63d41bde8c975f267e31015648
SHA1

6231cc028700c6bcc7d9e8b5101bf2bb7e9cbade
SHA256

dc32709098456e6e1495af73988369363a4a73f2c3a98cb4cbb82f425bf86d3c
SHA512

9dfa303c057ee0904ff1b43d2da79f92f9f81e7f92382729158bcf410cfd13a218d00a5a969b497945b858247c15d387158e5828a43f5acfcaf010a5b725a4d5
SSDEEP

12288:U7m7rgsW4GQoY/b3hbQQtbKNvX1Bte9onBT0G:mWrgDQoYTlhyBtI6BT0G

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	1916	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2932	1916	2cc82d63d41bde8c975f267e31015648.exe	28
PID 1916 wrote to memory of 2932	1916	2cc82d63d41bde8c975f267e31015648.exe	28
PID 1916 wrote to memory of 2932	1916	2cc82d63d41bde8c975f267e31015648.exe	28
PID 1916 wrote to memory of 2932	1916	2cc82d63d41bde8c975f267e31015648.exe	28

C:\Users\Admin\AppData\Local\Temp\2cc82d63d41bde8c975f267e31015648.exe
"C:\Users\Admin\AppData\Local\Temp\2cc82d63d41bde8c975f267e31015648.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 192
  2⤵
  - Program crash
  PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-0-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1916-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1916-2-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1916-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download