081bd80d60414fff585dbb39da9a0674d3052c466c1748e4ddd8935691f32a33 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:48

Sharing

Report Analysis Logs

General

Target

04d1b7d3c8382a2a5b642d5817a6c044.exe
Size

20KB
MD5

04d1b7d3c8382a2a5b642d5817a6c044
SHA1

1e62257406ec9552dea2509b99a41a8652c53b3a
SHA256

081bd80d60414fff585dbb39da9a0674d3052c466c1748e4ddd8935691f32a33
SHA512

ab8447ade1902bdd5759a42e64caadd72a03d4463a4ee90363e725a3edafff0d0a34aa11c662396b67dd65ad4faaea01c9a366d8f949024a8bf6a03505a062a8
SSDEEP

384:jSPAc7GfBOrsitJBp1weYs/bA166Q1lemFnd:WPAmGkr4eYm6QuQnd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1644	2496	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1644	2496	04d1b7d3c8382a2a5b642d5817a6c044.exe	14
PID 2496 wrote to memory of 1644	2496	04d1b7d3c8382a2a5b642d5817a6c044.exe	14
PID 2496 wrote to memory of 1644	2496	04d1b7d3c8382a2a5b642d5817a6c044.exe	14
PID 2496 wrote to memory of 1644	2496	04d1b7d3c8382a2a5b642d5817a6c044.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 88
1⤵
- Program crash
PID:1644

C:\Users\Admin\AppData\Local\Temp\04d1b7d3c8382a2a5b642d5817a6c044.exe
"C:\Users\Admin\AppData\Local\Temp\04d1b7d3c8382a2a5b642d5817a6c044.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download