04f4fa36c6fdabc5be5435de6275a5acc469e0fb5470153da9d230dcc20a1e18 | Triage

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:04

Sharing

Report Analysis Logs

General

Target

3a1278e90b39c4de1f476720e60e3211.exe
Size

238KB
MD5

3a1278e90b39c4de1f476720e60e3211
SHA1

d250a3d4286ab37b759faacbae6710102bacf80b
SHA256

04f4fa36c6fdabc5be5435de6275a5acc469e0fb5470153da9d230dcc20a1e18
SHA512

38558c9b3509aed94156cea1021028fc8356f444935dbf2b5845988aa504e389c8ad3a4a14c85ba5636fce9ee8f6121ecbdf212d58e5cb19c66e17d431ea0445
SSDEEP

6144:5uXlloyHq1q0TdsUV8Aw0CXxR9o4jthXrzruXPQ:5uVDKM0TeU1wfR9pjbru/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	1300	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1244	1300	3a1278e90b39c4de1f476720e60e3211.exe	28
PID 1300 wrote to memory of 1244	1300	3a1278e90b39c4de1f476720e60e3211.exe	28
PID 1300 wrote to memory of 1244	1300	3a1278e90b39c4de1f476720e60e3211.exe	28
PID 1300 wrote to memory of 1244	1300	3a1278e90b39c4de1f476720e60e3211.exe	28

C:\Users\Admin\AppData\Local\Temp\3a1278e90b39c4de1f476720e60e3211.exe
"C:\Users\Admin\AppData\Local\Temp\3a1278e90b39c4de1f476720e60e3211.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 116
  2⤵
  - Program crash
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads