cb73cc69bc55a91764b575fb9be284e24a8bc74bb9f542404699cc95c95b02a2 | Triage

Analysis

max time kernel
196s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:03

Sharing

Report Analysis Logs

General

Target

62178724f8ac281d5a5f187454f38b7c.exe
Size

77KB
MD5

62178724f8ac281d5a5f187454f38b7c
SHA1

77df8079c62fe2c6b934d9f3cd8d271788b26e4c
SHA256

cb73cc69bc55a91764b575fb9be284e24a8bc74bb9f542404699cc95c95b02a2
SHA512

bfa73fa66c0ba6ec8612c8b85447a2ca416a5f6d20451aa5458d65d1d8aca1eab2708baeb5751fb688523f646c38868320652f0fe89561ad7c8473c4548be0be
SSDEEP

1536:kAUDxX+IOIchTNDObEkd1JGsVR6ttC37VLasqt:kAUFwTlObJd1Jb6B

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	2736	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2772	2736	62178724f8ac281d5a5f187454f38b7c.exe	29
PID 2736 wrote to memory of 2772	2736	62178724f8ac281d5a5f187454f38b7c.exe	29
PID 2736 wrote to memory of 2772	2736	62178724f8ac281d5a5f187454f38b7c.exe	29
PID 2736 wrote to memory of 2772	2736	62178724f8ac281d5a5f187454f38b7c.exe	29

C:\Users\Admin\AppData\Local\Temp\62178724f8ac281d5a5f187454f38b7c.exe
"C:\Users\Admin\AppData\Local\Temp\62178724f8ac281d5a5f187454f38b7c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 100
  2⤵
  - Program crash
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2736-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2736-2-0x0000000000220000-0x0000000000236000-memory.dmp

Filesize
88KB

Download
memory/2736-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download