57d3be5e3c65cb2d72d20778fd71b9259f06eb8b6d72e267bca3413553131a14 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:55

Sharing

Report Analysis Logs

General

Target

07ad743f934a144c3dcf5af40799e70d.exe
Size

128KB
MD5

07ad743f934a144c3dcf5af40799e70d
SHA1

fdba7f8df02825192d34302fac6a693f8dbce3cf
SHA256

57d3be5e3c65cb2d72d20778fd71b9259f06eb8b6d72e267bca3413553131a14
SHA512

c6ebfdf1f993d4cb4c57db27aba98f67b02eca553b392285f814edc6cf1cf47ae249839c28cae485f6b482855dae2a87e0af06049b19e01a902a51ee9e61017e
SSDEEP

3072:hQqRK/MUq0XcrP6O2kPhyaYVmZF32J9Q2KlGNjVYzn:2dFXcT2kYgeLBNjq7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	1732	WerFault.exe	10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	07ad743f934a144c3dcf5af40799e70d.exe
1732	07ad743f934a144c3dcf5af40799e70d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2156	1732	07ad743f934a144c3dcf5af40799e70d.exe	28
PID 1732 wrote to memory of 2156	1732	07ad743f934a144c3dcf5af40799e70d.exe	28
PID 1732 wrote to memory of 2156	1732	07ad743f934a144c3dcf5af40799e70d.exe	28
PID 1732 wrote to memory of 2156	1732	07ad743f934a144c3dcf5af40799e70d.exe	28

C:\Users\Admin\AppData\Local\Temp\07ad743f934a144c3dcf5af40799e70d.exe
"C:\Users\Admin\AppData\Local\Temp\07ad743f934a144c3dcf5af40799e70d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 44
  2⤵
  - Program crash
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x0000000000400000-0x0000000000421200-memory.dmp

Filesize
132KB

Download