4f94072369d6668ee170f4be93e426cb796b22ff28ab4bf4d97a58fb57c98c61 | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:53

Sharing

Report Analysis Logs

General

Target

04e749bfd5bcef0470337cb6ee86bd13.exe
Size

3.3MB
MD5

04e749bfd5bcef0470337cb6ee86bd13
SHA1

c677f58e022486f125f4f0975fc49010ad9858de
SHA256

4f94072369d6668ee170f4be93e426cb796b22ff28ab4bf4d97a58fb57c98c61
SHA512

af834d111c7a5a1f6ead6aab300ce9713bb770fee1c258b45359ab28edd7958d3cefb00c088dc0630fd08e3cda8879f2da76c012a6a2fd294d51f6edcc3cbcf2
SSDEEP

49152:rd0H1Xz0fO2RbsTsas98W7UJCc5Z8Oz8XaCXY:re1aO8bn2W7UJCc5Z88r

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2744	2488	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2744	2488	04e749bfd5bcef0470337cb6ee86bd13.exe	28
PID 2488 wrote to memory of 2744	2488	04e749bfd5bcef0470337cb6ee86bd13.exe	28
PID 2488 wrote to memory of 2744	2488	04e749bfd5bcef0470337cb6ee86bd13.exe	28
PID 2488 wrote to memory of 2744	2488	04e749bfd5bcef0470337cb6ee86bd13.exe	28

C:\Users\Admin\AppData\Local\Temp\04e749bfd5bcef0470337cb6ee86bd13.exe
"C:\Users\Admin\AppData\Local\Temp\04e749bfd5bcef0470337cb6ee86bd13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 292
  2⤵
  - Program crash
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2488-1-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download
memory/2488-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download