e3bdbbeae2bd0b607922b9f7ffe33cc52df064b7351284435c15beb540b9af22 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:18

Sharing

Report Analysis Logs

General

Target

003d804f57fd2f1d78817e84aed0158a.exe
Size

25KB
MD5

003d804f57fd2f1d78817e84aed0158a
SHA1

1e766ec53327babf33502e2977fe34501464d121
SHA256

e3bdbbeae2bd0b607922b9f7ffe33cc52df064b7351284435c15beb540b9af22
SHA512

89dd8d07253c8032746d0c426da31ad1c490df6ca9cf068d2e05ced8f98a5f0dc2fb49851cc30d09a5c1b863d85e025e7156ceb1bbd57a704352943dadbe4b9a
SSDEEP

768:hQRbV4tHpl5j4dnYL33333ELR9ZEdbWbG:m5itTRI833333EbZEUS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1716	2100	003d804f57fd2f1d78817e84aed0158a.exe	28
PID 2100 wrote to memory of 1716	2100	003d804f57fd2f1d78817e84aed0158a.exe	28
PID 2100 wrote to memory of 1716	2100	003d804f57fd2f1d78817e84aed0158a.exe	28
PID 2100 wrote to memory of 1716	2100	003d804f57fd2f1d78817e84aed0158a.exe	28

C:\Users\Admin\AppData\Local\Temp\003d804f57fd2f1d78817e84aed0158a.exe
"C:\Users\Admin\AppData\Local\Temp\003d804f57fd2f1d78817e84aed0158a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 64
  2⤵
  - Program crash
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads