12b9d01b12f043418e2fa14279cca8c825a0f7ecae5205636f33292217ac0128 | Triage

Analysis

max time kernel
142s
max time network
35s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:30

Sharing

Report Analysis Logs

General

Target

0084940a0b08644cb5286f4078cc5bf3.exe
Size

423KB
MD5

0084940a0b08644cb5286f4078cc5bf3
SHA1

7f9d58f2e3a27f74e6842947808a03d4cb7ae96b
SHA256

12b9d01b12f043418e2fa14279cca8c825a0f7ecae5205636f33292217ac0128
SHA512

a6cdac6a9fcaeff02c5cba04431344333ccea896c253271ab5ec0f942e70e622edae5468ca88465ca602936f6df257a2c93430034c9f63818daa54085f7589c8
SSDEEP

12288:gQX0l6xzm2NcffEbvbwAkm17HWrNtTirdC7:SEzPN93z+TEdy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	1372	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2340	1372	0084940a0b08644cb5286f4078cc5bf3.exe	28
PID 1372 wrote to memory of 2340	1372	0084940a0b08644cb5286f4078cc5bf3.exe	28
PID 1372 wrote to memory of 2340	1372	0084940a0b08644cb5286f4078cc5bf3.exe	28
PID 1372 wrote to memory of 2340	1372	0084940a0b08644cb5286f4078cc5bf3.exe	28

C:\Users\Admin\AppData\Local\Temp\0084940a0b08644cb5286f4078cc5bf3.exe
"C:\Users\Admin\AppData\Local\Temp\0084940a0b08644cb5286f4078cc5bf3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 120
  2⤵
  - Program crash
  PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-0-0x0000000000400000-0x000000000053B200-memory.dmp

Filesize
1.2MB

Download
memory/1372-1-0x0000000000400000-0x000000000053B200-memory.dmp

Filesize
1.2MB

Download