59f99802b29188207a3b60837cc1838ff2aaa2b6b3bc45824d99a06ec7657004 | Triage

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:26

Sharing

Report Analysis Logs

General

Target

f93ef6416990fb0d56b3e63e7429508d.exe
Size

40KB
MD5

f93ef6416990fb0d56b3e63e7429508d
SHA1

a965b77b985e3e04fdff42b3e6cd8eefba4a2680
SHA256

59f99802b29188207a3b60837cc1838ff2aaa2b6b3bc45824d99a06ec7657004
SHA512

51a2c211d42e194837a57716990114ab9cbc5ff52295fcf65abf9d5a84ccc659ffe595b94b4cbe5d26a3315a1c2e2559146a9317ccecd876bbef6205f12fabc0
SSDEEP

384:LuoYhnOyhutP/o/dBC8HYesuwwzi1KXeCGbFWtk:GOsududInuwmZcFWt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	2220	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2084	2220	f93ef6416990fb0d56b3e63e7429508d.exe	28
PID 2220 wrote to memory of 2084	2220	f93ef6416990fb0d56b3e63e7429508d.exe	28
PID 2220 wrote to memory of 2084	2220	f93ef6416990fb0d56b3e63e7429508d.exe	28
PID 2220 wrote to memory of 2084	2220	f93ef6416990fb0d56b3e63e7429508d.exe	28

C:\Users\Admin\AppData\Local\Temp\f93ef6416990fb0d56b3e63e7429508d.exe
"C:\Users\Admin\AppData\Local\Temp\f93ef6416990fb0d56b3e63e7429508d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 44
  2⤵
  - Program crash
  PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads