8e7a59d35f8d0914982c99d2ff901390de333948807ce8f7344c2c32312d6f2e | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:09

Sharing

Report Analysis Logs

General

Target

530b7757512ceffe0d9bbc24cbcde4a4.exe
Size

132KB
MD5

530b7757512ceffe0d9bbc24cbcde4a4
SHA1

bd4855f82b77dec08e882ed86f7f11c3db45b0f9
SHA256

8e7a59d35f8d0914982c99d2ff901390de333948807ce8f7344c2c32312d6f2e
SHA512

fe8f45060d244ace2d1586df0a2258bf8f0639bab4b80beaf912d5e47b9be6f01bf7b7919d7c22cc3b289b485dabca4533a8e2a146e14a4b2d2b2eb7014ce993
SSDEEP

3072:+cQlNmMXxOl40+bCPEzJQsH4/OlcSYsX:uNJXElTcz+x/OKSY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	2176	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1204	2176	530b7757512ceffe0d9bbc24cbcde4a4.exe	28
PID 2176 wrote to memory of 1204	2176	530b7757512ceffe0d9bbc24cbcde4a4.exe	28
PID 2176 wrote to memory of 1204	2176	530b7757512ceffe0d9bbc24cbcde4a4.exe	28
PID 2176 wrote to memory of 1204	2176	530b7757512ceffe0d9bbc24cbcde4a4.exe	28

C:\Users\Admin\AppData\Local\Temp\530b7757512ceffe0d9bbc24cbcde4a4.exe
"C:\Users\Admin\AppData\Local\Temp\530b7757512ceffe0d9bbc24cbcde4a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 116
  2⤵
  - Program crash
  PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads