894a2f66b63f587bfddfefd059e4efcdec474f9ae36385e5c1e6802a0d6a34f4 | Triage

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:48

Sharing

Report Analysis Logs

General

Target

07814bb0fd495c290f0bbaecd50ba553.exe
Size

105KB
MD5

07814bb0fd495c290f0bbaecd50ba553
SHA1

73f8d533605183bc1616c5d4d04352528828fb93
SHA256

894a2f66b63f587bfddfefd059e4efcdec474f9ae36385e5c1e6802a0d6a34f4
SHA512

3be4c32bf50485e3f52e29bcfbbe093511ecd3761834a6b4455846b2f806314d9c6cebed1d83ebf53c6b30912a81daf1f8caf946b6becb3485033a4a80655a3a
SSDEEP

3072:jJ68ByxjZ9sy8qwqMOalqjJlC8UIk0z2a27bDkMr:Y8Byx3zSOyaH5w0f27bHr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2472	2100	07814bb0fd495c290f0bbaecd50ba553.exe	28
PID 2100 wrote to memory of 2472	2100	07814bb0fd495c290f0bbaecd50ba553.exe	28
PID 2100 wrote to memory of 2472	2100	07814bb0fd495c290f0bbaecd50ba553.exe	28
PID 2100 wrote to memory of 2472	2100	07814bb0fd495c290f0bbaecd50ba553.exe	28

C:\Users\Admin\AppData\Local\Temp\07814bb0fd495c290f0bbaecd50ba553.exe
"C:\Users\Admin\AppData\Local\Temp\07814bb0fd495c290f0bbaecd50ba553.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 36
  2⤵
  - Program crash
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download