8b665892869e1d13c07d0647eece3231300a8b2d1afeabc2e1bef0abee645aee | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 08:52

Sharing

Report Analysis Logs

General

Target

615007459acd7390e0b99697900a690f.exe
Size

323KB
MD5

615007459acd7390e0b99697900a690f
SHA1

8dc319247797b01373af40422539315912c5ffbc
SHA256

8b665892869e1d13c07d0647eece3231300a8b2d1afeabc2e1bef0abee645aee
SHA512

ca6f3cdc39f1a7a04a6fdfef5bbc4daa0d8c9323c6d2a92de181574b38e967566ece31588e16d9dbd118511079b203b631a11904e81984ba80abc207cefd93ef
SSDEEP

6144:NAeycSlljd3rKzwN8Jlljd3njPX9ZAk3fs:+eMjpKXjtjP9Zt0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	2336	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2032	2336	615007459acd7390e0b99697900a690f.exe	16
PID 2336 wrote to memory of 2032	2336	615007459acd7390e0b99697900a690f.exe	16
PID 2336 wrote to memory of 2032	2336	615007459acd7390e0b99697900a690f.exe	16
PID 2336 wrote to memory of 2032	2336	615007459acd7390e0b99697900a690f.exe	16

C:\Users\Admin\AppData\Local\Temp\615007459acd7390e0b99697900a690f.exe
"C:\Users\Admin\AppData\Local\Temp\615007459acd7390e0b99697900a690f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 140
  2⤵
  - Program crash
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download