f6a766d7def1492bcf5ac0dbcf030596c136735f4b21ed94ca6789814fc5fc2c | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 11:29

Sharing

Report Analysis Logs

General

Target

6ad7fddb98e31b291cf65f2d1ea66075.exe
Size

64KB
MD5

6ad7fddb98e31b291cf65f2d1ea66075
SHA1

91c371b7e53b293476a0f247d0e5d895c48b6328
SHA256

f6a766d7def1492bcf5ac0dbcf030596c136735f4b21ed94ca6789814fc5fc2c
SHA512

336a07e9f33c0858d09abb6cef62834acd08de42428690d2facfac07cb117d1815307f5163c922c7c95cdfc9c24a824c1afdb1d1a1f7ea5ba05448354a550001
SSDEEP

1536:FnXjEbnWNgJR+zvfSdlLfFqm8xYc2L5sBMu/H1:JCWNg6zHM1fFIYV5aN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	2872	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2024	2872	6ad7fddb98e31b291cf65f2d1ea66075.exe	28
PID 2872 wrote to memory of 2024	2872	6ad7fddb98e31b291cf65f2d1ea66075.exe	28
PID 2872 wrote to memory of 2024	2872	6ad7fddb98e31b291cf65f2d1ea66075.exe	28
PID 2872 wrote to memory of 2024	2872	6ad7fddb98e31b291cf65f2d1ea66075.exe	28

C:\Users\Admin\AppData\Local\Temp\6ad7fddb98e31b291cf65f2d1ea66075.exe
"C:\Users\Admin\AppData\Local\Temp\6ad7fddb98e31b291cf65f2d1ea66075.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 140
  2⤵
  - Program crash
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download