9e357e4f263d85ce5d9310d18a97fbee391afdc12675c95a69a0b359f56c8f47 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:30

Sharing

Report Analysis Logs

General

Target

032ba8e4969c3122d67645f16d8880e9.exe
Size

521KB
MD5

032ba8e4969c3122d67645f16d8880e9
SHA1

9b12b4aceabd0d58d0cd1ebf4305b0ef5e38e00b
SHA256

9e357e4f263d85ce5d9310d18a97fbee391afdc12675c95a69a0b359f56c8f47
SHA512

6cf601a61790bc170e08238f3dca5191324816135c333c96b749dfe9196ee8339ad8cd6fc64418578dff6bd73d9332c755b7f272f8b9b4a032f8e83048b58734
SSDEEP

12288:+P+by/y/y/yS5syS5Z5syS5sy/y/y/yS5syg:+aaa2S2aaa2g

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	2232	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 640	2232	032ba8e4969c3122d67645f16d8880e9.exe	28
PID 2232 wrote to memory of 640	2232	032ba8e4969c3122d67645f16d8880e9.exe	28
PID 2232 wrote to memory of 640	2232	032ba8e4969c3122d67645f16d8880e9.exe	28
PID 2232 wrote to memory of 640	2232	032ba8e4969c3122d67645f16d8880e9.exe	28

C:\Users\Admin\AppData\Local\Temp\032ba8e4969c3122d67645f16d8880e9.exe
"C:\Users\Admin\AppData\Local\Temp\032ba8e4969c3122d67645f16d8880e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 92
  2⤵
  - Program crash
  PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads