2dc132a3974eb1856ec1e32b6226912fe046b29b4f1096a2dd6829ee35a84d4b | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:25

Sharing

Report Analysis Logs

General

Target

01a4c3f191a85c2a75d7c857b18faa12.exe
Size

368KB
MD5

01a4c3f191a85c2a75d7c857b18faa12
SHA1

c23f5958e4f8604a11320e2da9ca7d480da3cd52
SHA256

2dc132a3974eb1856ec1e32b6226912fe046b29b4f1096a2dd6829ee35a84d4b
SHA512

52c760b9fa77a64bcc789d89e5250f5f211e6dbc1e815406dd49b8b711d3fb6af94a617fe54aef6aa79ad8a8ff50ae89696a2aaf516fcd3e26d254b02ada5e86
SSDEEP

6144:PflQX1xqaGqqCG6K3SDdAlYUor8uyK1INkVsuaRaU6mHG:X+nU0Tz40aRz6mHG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1112	2056	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1112	2056	01a4c3f191a85c2a75d7c857b18faa12.exe	28
PID 2056 wrote to memory of 1112	2056	01a4c3f191a85c2a75d7c857b18faa12.exe	28
PID 2056 wrote to memory of 1112	2056	01a4c3f191a85c2a75d7c857b18faa12.exe	28
PID 2056 wrote to memory of 1112	2056	01a4c3f191a85c2a75d7c857b18faa12.exe	28
PID 2056 wrote to memory of 1112	2056	01a4c3f191a85c2a75d7c857b18faa12.exe	28
PID 2056 wrote to memory of 1112	2056	01a4c3f191a85c2a75d7c857b18faa12.exe	28
PID 2056 wrote to memory of 1112	2056	01a4c3f191a85c2a75d7c857b18faa12.exe	28

C:\Users\Admin\AppData\Local\Temp\01a4c3f191a85c2a75d7c857b18faa12.exe
"C:\Users\Admin\AppData\Local\Temp\01a4c3f191a85c2a75d7c857b18faa12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 280
  2⤵
  - Program crash
  PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads