d8f780c65857afac996580fd90319d21a62cd61befe42c0c3225530f263053b4 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:50

Sharing

Report Analysis Logs

General

Target

04db2e17db3ff60fe18c4155af64fef4.exe
Size

18KB
MD5

04db2e17db3ff60fe18c4155af64fef4
SHA1

9a014bac7a4fc9c4621b212b07e7999519f0028b
SHA256

d8f780c65857afac996580fd90319d21a62cd61befe42c0c3225530f263053b4
SHA512

b29479a5f076b31dce34b89646d0939f0cff13e4e4345d3f8421051d687a31e3131078107fd98b17a49e48dae6be53a462bd4c6339767bfeefab19cfbeccebc6
SSDEEP

384:aQei32vDEbC2+rBgYGYu+y6x0gwyvt4SRK57ec:ati32EC2sx6bfyv6wKsc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	2104	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3052	2104	04db2e17db3ff60fe18c4155af64fef4.exe	28
PID 2104 wrote to memory of 3052	2104	04db2e17db3ff60fe18c4155af64fef4.exe	28
PID 2104 wrote to memory of 3052	2104	04db2e17db3ff60fe18c4155af64fef4.exe	28
PID 2104 wrote to memory of 3052	2104	04db2e17db3ff60fe18c4155af64fef4.exe	28

C:\Users\Admin\AppData\Local\Temp\04db2e17db3ff60fe18c4155af64fef4.exe
"C:\Users\Admin\AppData\Local\Temp\04db2e17db3ff60fe18c4155af64fef4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 88
  2⤵
  - Program crash
  PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2104-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2104-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download