d39e39d1cab8ed9295f52256df1229997d1f27c7c71939eb29b79cb329a73dc6 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:37

Sharing

Report Analysis Logs

General

Target

3168f4d5cdc232eb6d65f5f2af9c249a.exe
Size

3.6MB
MD5

3168f4d5cdc232eb6d65f5f2af9c249a
SHA1

caa8bc43ae9263acb1ab8bbbe2aca1b79b03cfb8
SHA256

d39e39d1cab8ed9295f52256df1229997d1f27c7c71939eb29b79cb329a73dc6
SHA512

851f969a13eddbf8a58ab41c4f970f0318499e86ff07b9e8b78bc281f00b4ebf76edb55f7d0e1962b230966c2c29f75a97bc7cc3031330b5185e5362732a02c6
SSDEEP

49152:zAdGB73ejP3+EMfRdASVaAvrN5Xh602+:zAgR3epMjASHPh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2328	2028	3168f4d5cdc232eb6d65f5f2af9c249a.exe	29
PID 2028 wrote to memory of 2328	2028	3168f4d5cdc232eb6d65f5f2af9c249a.exe	29
PID 2028 wrote to memory of 2328	2028	3168f4d5cdc232eb6d65f5f2af9c249a.exe	29
PID 2028 wrote to memory of 2328	2028	3168f4d5cdc232eb6d65f5f2af9c249a.exe	29

C:\Users\Admin\AppData\Local\Temp\3168f4d5cdc232eb6d65f5f2af9c249a.exe
"C:\Users\Admin\AppData\Local\Temp\3168f4d5cdc232eb6d65f5f2af9c249a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 104
  2⤵
  - Program crash
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads