96716f7606fc57272c5e210e624bc8e82811194c7befcb3229df84d3b04772af | Triage

Analysis

max time kernel
16s
max time network
39s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:39

Sharing

Report Analysis Logs

General

Target

49f99e23d83d86d78a5fb35f351519bc.exe
Size

484KB
MD5

49f99e23d83d86d78a5fb35f351519bc
SHA1

d3dc17514cb76ea680c6a29d7c611b92cc118fa2
SHA256

96716f7606fc57272c5e210e624bc8e82811194c7befcb3229df84d3b04772af
SHA512

f776a2568b3ee9955ee4d1a8ec1dc251b0a3ab61248fecc62f42a623cd66c9972158c83360154a9569bd3376c4f8d8a7863cd06dd2903f21a44805fdbdc7cfc3
SSDEEP

12288:t71xLxTZWQsiNT7LtbqTCbPs0ju264rlC:tDLxzf2fr4rl

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2116	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2756	2116	49f99e23d83d86d78a5fb35f351519bc.exe	28
PID 2116 wrote to memory of 2756	2116	49f99e23d83d86d78a5fb35f351519bc.exe	28
PID 2116 wrote to memory of 2756	2116	49f99e23d83d86d78a5fb35f351519bc.exe	28
PID 2116 wrote to memory of 2756	2116	49f99e23d83d86d78a5fb35f351519bc.exe	28

C:\Users\Admin\AppData\Local\Temp\49f99e23d83d86d78a5fb35f351519bc.exe
"C:\Users\Admin\AppData\Local\Temp\49f99e23d83d86d78a5fb35f351519bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 36
  2⤵
  - Program crash
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads