1d0b24f0912bc4f4ee562afe1b3f9d930a42b47c351448efb3676505d6d70384 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:49

Sharing

Report Analysis Logs

General

Target

00ebf8cad525fbb80bfb5f847d994dd4.exe
Size

126KB
MD5

00ebf8cad525fbb80bfb5f847d994dd4
SHA1

abb38f49f3d4d2d95bd07f8cb5bf9df3d4971230
SHA256

1d0b24f0912bc4f4ee562afe1b3f9d930a42b47c351448efb3676505d6d70384
SHA512

3fb75148d91e86066c2e73dd5f4b94c29ce16c9797bde454ce6ea59439996101cd03ea8a227dc9bab05a02ca1f6e97672554259450084d04865f2212db9884a4
SSDEEP

3072:wPDgBKhy/EnIExnvCCP0DZf0wGVP4HjwflkAhV5:YgBKhymxnvUV9GAHsfl5l

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	2092	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 620	2092	00ebf8cad525fbb80bfb5f847d994dd4.exe	28
PID 2092 wrote to memory of 620	2092	00ebf8cad525fbb80bfb5f847d994dd4.exe	28
PID 2092 wrote to memory of 620	2092	00ebf8cad525fbb80bfb5f847d994dd4.exe	28
PID 2092 wrote to memory of 620	2092	00ebf8cad525fbb80bfb5f847d994dd4.exe	28

C:\Users\Admin\AppData\Local\Temp\00ebf8cad525fbb80bfb5f847d994dd4.exe
"C:\Users\Admin\AppData\Local\Temp\00ebf8cad525fbb80bfb5f847d994dd4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 36
  2⤵
  - Program crash
  PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2092-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download