b3873c4c1f254f046292bd8e65351ef0606c4c11dd71d43e6731d456b202dfd1 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5cde3baf70b1239796f6fe37b0b67fb2.exe
Size

57KB
MD5

5cde3baf70b1239796f6fe37b0b67fb2
SHA1

f8399f9b568dbd4c314a08fd4a11478a6e10a62e
SHA256

b3873c4c1f254f046292bd8e65351ef0606c4c11dd71d43e6731d456b202dfd1
SHA512

0405067e79736f1d60336ebf0c0b024d170a219dfeabfbfcafd47876df3e633d5f92084c6fa4253cbebde8dc3dfbd009d4339257390cc4752f04e16bbca41d70
SSDEEP

1536:aARR4AJ+o/k+WKs0cZlj6aFZgM4RtysNpVvxJ:3RKa+o/k+WKs5Z56lMW19vx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	2352	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2064	2352	5cde3baf70b1239796f6fe37b0b67fb2.exe	28
PID 2352 wrote to memory of 2064	2352	5cde3baf70b1239796f6fe37b0b67fb2.exe	28
PID 2352 wrote to memory of 2064	2352	5cde3baf70b1239796f6fe37b0b67fb2.exe	28
PID 2352 wrote to memory of 2064	2352	5cde3baf70b1239796f6fe37b0b67fb2.exe	28

C:\Users\Admin\AppData\Local\Temp\5cde3baf70b1239796f6fe37b0b67fb2.exe
"C:\Users\Admin\AppData\Local\Temp\5cde3baf70b1239796f6fe37b0b67fb2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 36
  2⤵
  - Program crash
  PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download