83192a15b2ecf9cf2e8d63f60668ac183661bc1f88624265a0a29f266c8b7686 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:08

Sharing

Report Analysis Logs

General

Target

4b9a3db766b7dcfe799f342aaba15f2e.exe
Size

42KB
MD5

4b9a3db766b7dcfe799f342aaba15f2e
SHA1

479d6a1d2799171b79f3eaa62a5ba5816801e529
SHA256

83192a15b2ecf9cf2e8d63f60668ac183661bc1f88624265a0a29f266c8b7686
SHA512

ef69e6ee74e5e4a3111170b0c91d07acec0e6ae267e54f2bcec5398e4af286e5e2cc71dd2e663ae05d10b648a2b5216b90510084cbd78b2ff2cf7c5d9dac96ef
SSDEEP

768:eJltSPHsshUEtI8GGPty27ZviDflatmOPa7:ySMGl57ZaDdatX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	2088	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1756	2088	4b9a3db766b7dcfe799f342aaba15f2e.exe	29
PID 2088 wrote to memory of 1756	2088	4b9a3db766b7dcfe799f342aaba15f2e.exe	29
PID 2088 wrote to memory of 1756	2088	4b9a3db766b7dcfe799f342aaba15f2e.exe	29
PID 2088 wrote to memory of 1756	2088	4b9a3db766b7dcfe799f342aaba15f2e.exe	29

C:\Users\Admin\AppData\Local\Temp\4b9a3db766b7dcfe799f342aaba15f2e.exe
"C:\Users\Admin\AppData\Local\Temp\4b9a3db766b7dcfe799f342aaba15f2e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 52
  2⤵
  - Program crash
  PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads