dde882918a7f9989bd70ba3f8d15f6e8086318e20c32bf08c3b8ede22fdc1606 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69f20aaad4be0bb2ad4034d3df41b3a0.exe
Size

904KB
MD5

69f20aaad4be0bb2ad4034d3df41b3a0
SHA1

11c0df07100b417e71ccb728cce81f161f3ae556
SHA256

dde882918a7f9989bd70ba3f8d15f6e8086318e20c32bf08c3b8ede22fdc1606
SHA512

2b1f1fa3a38a45469ba0e1fb2b2758c096af12164494369815fcd37951684054b5450f58b9bcd0e00538586e3ea489aa59fe87c0cc955c2123944073e0751ffc
SSDEEP

3072:ft2cWtTBfVkfqM2SCAygRjlIqZoFzJcqIUv:hWtTBdsqEPxjjoFz5v

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1752	2340	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1752	2340	69f20aaad4be0bb2ad4034d3df41b3a0.exe	16
PID 2340 wrote to memory of 1752	2340	69f20aaad4be0bb2ad4034d3df41b3a0.exe	16
PID 2340 wrote to memory of 1752	2340	69f20aaad4be0bb2ad4034d3df41b3a0.exe	16
PID 2340 wrote to memory of 1752	2340	69f20aaad4be0bb2ad4034d3df41b3a0.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 36
1⤵
- Program crash
PID:1752

C:\Users\Admin\AppData\Local\Temp\69f20aaad4be0bb2ad4034d3df41b3a0.exe
"C:\Users\Admin\AppData\Local\Temp\69f20aaad4be0bb2ad4034d3df41b3a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads