5c96cf76075e3f4a188eb26513adafaef359294df319c324f90a69f508da525d | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:54

Sharing

Report Analysis Logs

General

Target

f78a9599d4b0159f458cd5dbad133ee3.exe
Size

148KB
MD5

f78a9599d4b0159f458cd5dbad133ee3
SHA1

cd92f3971130c1fc368e2dee2075a1727a56ba12
SHA256

5c96cf76075e3f4a188eb26513adafaef359294df319c324f90a69f508da525d
SHA512

a859e99f9dfb0baf2fe5a2249276331c7ddc50e6fc312aaca2a9ec1c14cab0fbac81aafa301caecc766f5c165cfa6069d757c29ad71dcf96abec9259c582c350
SSDEEP

1536:Ja8ZSWkojFsO33SpJDTQIKK16LIlBJqZF:TtkAG036tTQIyX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2424	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2692	2424	f78a9599d4b0159f458cd5dbad133ee3.exe	28
PID 2424 wrote to memory of 2692	2424	f78a9599d4b0159f458cd5dbad133ee3.exe	28
PID 2424 wrote to memory of 2692	2424	f78a9599d4b0159f458cd5dbad133ee3.exe	28
PID 2424 wrote to memory of 2692	2424	f78a9599d4b0159f458cd5dbad133ee3.exe	28

C:\Users\Admin\AppData\Local\Temp\f78a9599d4b0159f458cd5dbad133ee3.exe
"C:\Users\Admin\AppData\Local\Temp\f78a9599d4b0159f458cd5dbad133ee3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 88
  2⤵
  - Program crash
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download