b0c31ad7678239cd78efc8395a8c4c78a502fa410a505eddd8872f6a9930f63a | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:46

Sharing

Report Analysis Logs

General

Target

6221.exe
Size

23KB
MD5

4e1ba3c84b4f3427e533857963b795d2
SHA1

8adac7bb70187b9c77a7f98b8708e1fc1c46324e
SHA256

3c08daf196cf0bef42f14d78602f97c72e60d1c79b46f5dd2d922766a9d8c136
SHA512

6e0d3a3009467995ff6b569db9db2ba762e606805d25287cbffba20037ee52ed7f8a0e3fd0117667bacfe7af8b68a1eeea3985b1c3226c08b5f50e5a1964e641
SSDEEP

384:AMTHz5QCAAdIw41Ms4DGlW/AM+o/8E9VF0NytM:AKTbKw2Ms4DGs/AMxkEc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 2228	864	6221.exe	27
PID 864 wrote to memory of 2228	864	6221.exe	27
PID 864 wrote to memory of 2228	864	6221.exe	27

C:\Users\Admin\AppData\Local\Temp\6221.exe
"C:\Users\Admin\AppData\Local\Temp\6221.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 864 -s 56
  2⤵
  PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads