58895d32dedb02a469cc7496068eeb271d444e9b792f09cb7aabb7d8bd5c4f24 | Triage

Analysis

max time kernel
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 06:54

Sharing

Report Analysis Logs

General

Target

5aee0b8df5c93721131abc72c9bb91c4.exe
Size

56KB
MD5

5aee0b8df5c93721131abc72c9bb91c4
SHA1

d0fdd90439d8cf58b25d517e9559ba941de8a8e5
SHA256

58895d32dedb02a469cc7496068eeb271d444e9b792f09cb7aabb7d8bd5c4f24
SHA512

79e91d049210c409175758ace589359843728b17e89e858a87d045eecf4d012836d756d7fcd90d95593e08141d09925a6d3f15eefbc99f72e6974a8df18cbc4a
SSDEEP

1536:/qpicEKGvzssdDjnypw6AfPQItWHtgOrk:ycPZLVjn5RQI0NgOQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	2964	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1912	2964	5aee0b8df5c93721131abc72c9bb91c4.exe	16
PID 2964 wrote to memory of 1912	2964	5aee0b8df5c93721131abc72c9bb91c4.exe	16
PID 2964 wrote to memory of 1912	2964	5aee0b8df5c93721131abc72c9bb91c4.exe	16
PID 2964 wrote to memory of 1912	2964	5aee0b8df5c93721131abc72c9bb91c4.exe	16

C:\Users\Admin\AppData\Local\Temp\5aee0b8df5c93721131abc72c9bb91c4.exe
"C:\Users\Admin\AppData\Local\Temp\5aee0b8df5c93721131abc72c9bb91c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 140
  2⤵
  - Program crash
  PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download