5b772fd63ccf780c263fa7121e5adf22b8cac310ed6977828b0280094ab62027 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:35

Sharing

Report Analysis Logs

General

Target

01e5d5511d185a3e67e1277759a8ccf6.exe
Size

106KB
MD5

01e5d5511d185a3e67e1277759a8ccf6
SHA1

329dbe8774497fe615debb350912f76361224203
SHA256

5b772fd63ccf780c263fa7121e5adf22b8cac310ed6977828b0280094ab62027
SHA512

18b7b9409097a232546a8881126546697f1ff28260e4b2f986c124e6c23591f969664a4dbf0b11d779c1db5033b9bf21c1b9afa52e453899e7605fd8da7d3186
SSDEEP

3072:JADeWnKREyUuazeP2t9u8/dNds1UzwaoDsTxgE0:WSEy4P9Tds1UzrEsTxl

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	1072	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1880	1072	01e5d5511d185a3e67e1277759a8ccf6.exe	28
PID 1072 wrote to memory of 1880	1072	01e5d5511d185a3e67e1277759a8ccf6.exe	28
PID 1072 wrote to memory of 1880	1072	01e5d5511d185a3e67e1277759a8ccf6.exe	28
PID 1072 wrote to memory of 1880	1072	01e5d5511d185a3e67e1277759a8ccf6.exe	28

C:\Users\Admin\AppData\Local\Temp\01e5d5511d185a3e67e1277759a8ccf6.exe
"C:\Users\Admin\AppData\Local\Temp\01e5d5511d185a3e67e1277759a8ccf6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 116
  2⤵
  - Program crash
  PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1072-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download