305ecddc7ff2fd850c98c836472d0b20b1cc9f05455bf1dd02c9608fc59d1ef8 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:37

Sharing

Report Analysis Logs

General

Target

0727148cd5cbf17569ca25284b13c760.exe
Size

244KB
MD5

0727148cd5cbf17569ca25284b13c760
SHA1

6f4287dda384c3e3b52574fb3b5b286ab55fdb53
SHA256

305ecddc7ff2fd850c98c836472d0b20b1cc9f05455bf1dd02c9608fc59d1ef8
SHA512

f239368ab84006ef7ed0fb329a42a1e28d108da44d4cc31e4f1d9d53509a39ba8338c4150d74eba60924f938472c3f320ee8e8e8f728bf61e485104be34c65e3
SSDEEP

6144:3kxjyiEXfzhHC0pxac51tUmNOfscrdXoI:3tiMtLpxacSPV

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2024	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2748	2024	0727148cd5cbf17569ca25284b13c760.exe	28
PID 2024 wrote to memory of 2748	2024	0727148cd5cbf17569ca25284b13c760.exe	28
PID 2024 wrote to memory of 2748	2024	0727148cd5cbf17569ca25284b13c760.exe	28
PID 2024 wrote to memory of 2748	2024	0727148cd5cbf17569ca25284b13c760.exe	28

C:\Users\Admin\AppData\Local\Temp\0727148cd5cbf17569ca25284b13c760.exe
"C:\Users\Admin\AppData\Local\Temp\0727148cd5cbf17569ca25284b13c760.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 36
  2⤵
  - Program crash
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download