a1ff015855ba1ac48cff4986392551677e9d949129821684a5e8fada6d6b3d80 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:36

Sharing

Report Analysis Logs

General

Target

2036bc58705189d6c3008ee24fb4c7db.exe
Size

7KB
MD5

2036bc58705189d6c3008ee24fb4c7db
SHA1

b040ef7a34533d6e3e42c0cca21140683282f994
SHA256

a1ff015855ba1ac48cff4986392551677e9d949129821684a5e8fada6d6b3d80
SHA512

89e879efdc41922d807a306bd1f90b6faa8e9067e3c14a5548fdd13e6966e1ac4f745e8710386dde5ce5d51eaf211b8a71ab4a8cde0ce041751c6f78136aacb5
SSDEEP

192:DLlwZxiWeirHZ5pzlmNXEXALsl7usOwni:n2oWnrHZvzQXbshu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	1904	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 848	1904	2036bc58705189d6c3008ee24fb4c7db.exe	28
PID 1904 wrote to memory of 848	1904	2036bc58705189d6c3008ee24fb4c7db.exe	28
PID 1904 wrote to memory of 848	1904	2036bc58705189d6c3008ee24fb4c7db.exe	28
PID 1904 wrote to memory of 848	1904	2036bc58705189d6c3008ee24fb4c7db.exe	28

C:\Users\Admin\AppData\Local\Temp\2036bc58705189d6c3008ee24fb4c7db.exe
"C:\Users\Admin\AppData\Local\Temp\2036bc58705189d6c3008ee24fb4c7db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 36
  2⤵
  - Program crash
  PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download