883d1efc118ea3af7a0dbef2587235507f7dd97ee35cab3776bae4dfa071f410 | Triage

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:59

Sharing

Report Analysis Logs

General

Target

32c6b9ea19011df250f7e0b28879bda2.exe
Size

8KB
MD5

32c6b9ea19011df250f7e0b28879bda2
SHA1

fe2d766f8d2427143ff2123d75a12f5bbf7a9ce1
SHA256

883d1efc118ea3af7a0dbef2587235507f7dd97ee35cab3776bae4dfa071f410
SHA512

0d34b2056c7312018b11c3732f86ca2a5da88ac6cc91e4f1e783cffb7ff33d8488129384ee7f9739896c767dfc40fda1a7ccb034ff2de1079f243d825746426e
SSDEEP

48:OEPjEyM6cgCdEd64b6U7+0ymE5FCh7VdIuPk8PAVoB:nPXM6me64mSZynMIdVo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1068	2356	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1068	2356	32c6b9ea19011df250f7e0b28879bda2.exe	29
PID 2356 wrote to memory of 1068	2356	32c6b9ea19011df250f7e0b28879bda2.exe	29
PID 2356 wrote to memory of 1068	2356	32c6b9ea19011df250f7e0b28879bda2.exe	29
PID 2356 wrote to memory of 1068	2356	32c6b9ea19011df250f7e0b28879bda2.exe	29

C:\Users\Admin\AppData\Local\Temp\32c6b9ea19011df250f7e0b28879bda2.exe
"C:\Users\Admin\AppData\Local\Temp\32c6b9ea19011df250f7e0b28879bda2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 48
  2⤵
  - Program crash
  PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download