77022f09eb90476893ca341f0868874fbe1b6e8dc131d483623619d48c1d6d75 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6718b14c3bb36dfd8bca5a65f86cc2b7.exe
Size

32KB
MD5

6718b14c3bb36dfd8bca5a65f86cc2b7
SHA1

34b2aff832878d22e5f1a2819112f27664667858
SHA256

77022f09eb90476893ca341f0868874fbe1b6e8dc131d483623619d48c1d6d75
SHA512

bb31cf7bb9194945c9f956eb11e2bd2c2a1a673069be3eb2bcb4220687f4f9158353d78c37238d99bb50581db905627d2f627fe8ea0010ac98a588958f064433
SSDEEP

384:W+fgXA82eoRsMrlzrkBVx5BjjCdT6siRbs6Xu:5kJoS2z4BVx5gviRbtXu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	2052	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2104	2052	6718b14c3bb36dfd8bca5a65f86cc2b7.exe	28
PID 2052 wrote to memory of 2104	2052	6718b14c3bb36dfd8bca5a65f86cc2b7.exe	28
PID 2052 wrote to memory of 2104	2052	6718b14c3bb36dfd8bca5a65f86cc2b7.exe	28
PID 2052 wrote to memory of 2104	2052	6718b14c3bb36dfd8bca5a65f86cc2b7.exe	28

C:\Users\Admin\AppData\Local\Temp\6718b14c3bb36dfd8bca5a65f86cc2b7.exe
"C:\Users\Admin\AppData\Local\Temp\6718b14c3bb36dfd8bca5a65f86cc2b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 88
  2⤵
  - Program crash
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download