8173514af97106b73aa2ea91f33d00bf34d3c8260b0ffe04785ab548a816d4fa | Triage

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:37

Sharing

Report Analysis Logs

General

Target

f67c7a6d67c9fb6ae66f998cecfd6425.exe
Size

116KB
MD5

f67c7a6d67c9fb6ae66f998cecfd6425
SHA1

99de80d50577cff015b26c5cc4719f5ff5483b4e
SHA256

8173514af97106b73aa2ea91f33d00bf34d3c8260b0ffe04785ab548a816d4fa
SHA512

44efcb344763fe5e87b0625d83d78d0d593c2efe772029128434cbe6d9e506876b114822802b714fd2f310981b3ea705c1b4e6f299365cacfabe70ccc3587249
SSDEEP

3072:Uaa0D1KkotKspI7Kc1nQIn8wBeKYVJlB1:EU0TIhP8bnVJ/1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	2508	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2632	2508	f67c7a6d67c9fb6ae66f998cecfd6425.exe	15
PID 2508 wrote to memory of 2632	2508	f67c7a6d67c9fb6ae66f998cecfd6425.exe	15
PID 2508 wrote to memory of 2632	2508	f67c7a6d67c9fb6ae66f998cecfd6425.exe	15
PID 2508 wrote to memory of 2632	2508	f67c7a6d67c9fb6ae66f998cecfd6425.exe	15

C:\Users\Admin\AppData\Local\Temp\f67c7a6d67c9fb6ae66f998cecfd6425.exe
"C:\Users\Admin\AppData\Local\Temp\f67c7a6d67c9fb6ae66f998cecfd6425.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 88
  2⤵
  - Program crash
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads