3c89ce0fe8aecd1b309a41c41a9af9c11c9b26b55ce41866469c216f47f71c0d | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

041e8e9ab7ec759ee0ac8de0e6ec258c.exe
Size

124KB
MD5

041e8e9ab7ec759ee0ac8de0e6ec258c
SHA1

d137641563d222821ea34a941bc2e27ed458190d
SHA256

3c89ce0fe8aecd1b309a41c41a9af9c11c9b26b55ce41866469c216f47f71c0d
SHA512

62515582a8adbec977e117f6687b6e89269f28385c6f3e9b9bd9af9b09b8adf651ea1dceda0f1040f8c875871c2bb3c11909981c2ce9f56200f88a842f496e5b
SSDEEP

3072:UcDPJdNzgHCkBjGmF/VkDahCDTobXxO6k:U2PVUCk1F/VklGFk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	2268	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2080	2268	041e8e9ab7ec759ee0ac8de0e6ec258c.exe	28
PID 2268 wrote to memory of 2080	2268	041e8e9ab7ec759ee0ac8de0e6ec258c.exe	28
PID 2268 wrote to memory of 2080	2268	041e8e9ab7ec759ee0ac8de0e6ec258c.exe	28
PID 2268 wrote to memory of 2080	2268	041e8e9ab7ec759ee0ac8de0e6ec258c.exe	28

C:\Users\Admin\AppData\Local\Temp\041e8e9ab7ec759ee0ac8de0e6ec258c.exe
"C:\Users\Admin\AppData\Local\Temp\041e8e9ab7ec759ee0ac8de0e6ec258c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 36
  2⤵
  - Program crash
  PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2268-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download