e911878f40d724d5370cb9522296f172ad6f34a39987308246e07a47d9806396 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 07:28

Sharing

Report Analysis Logs

General

Target

5c83ffa285d8be18094cf76a7fd4eb79.exe
Size

64KB
MD5

5c83ffa285d8be18094cf76a7fd4eb79
SHA1

acf766799a39d3003d11521342f76e1763612b1e
SHA256

e911878f40d724d5370cb9522296f172ad6f34a39987308246e07a47d9806396
SHA512

5343d173298110f9d069214ef20c344333bbca9ec3171835d73870df6c92b9859b5312591cdb1984e4a32e388a4da6e6e32199f1e5c621d4858e04168804db5f
SSDEEP

1536:SK3A9Ve4v4/RSGf+mf9iNwUJMMVIxWxfn3i6HVD:SK3ATxA4GW1vVkWxfv1D

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	804	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2868	804	5c83ffa285d8be18094cf76a7fd4eb79.exe	28
PID 804 wrote to memory of 2868	804	5c83ffa285d8be18094cf76a7fd4eb79.exe	28
PID 804 wrote to memory of 2868	804	5c83ffa285d8be18094cf76a7fd4eb79.exe	28
PID 804 wrote to memory of 2868	804	5c83ffa285d8be18094cf76a7fd4eb79.exe	28

C:\Users\Admin\AppData\Local\Temp\5c83ffa285d8be18094cf76a7fd4eb79.exe
"C:\Users\Admin\AppData\Local\Temp\5c83ffa285d8be18094cf76a7fd4eb79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 168
  2⤵
  - Program crash
  PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-0-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/804-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download