068ba29e284b53c93ac9863a037ebd038774a8ff274f0f7c059cc48e7b144ee1 | Triage

Analysis

max time kernel
138s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:43

Sharing

Report Analysis Logs

General

Target

08e8997089abcfa8af387781fddf5dc4.exe
Size

124KB
MD5

08e8997089abcfa8af387781fddf5dc4
SHA1

681cde7dde08b1b8a8f6d1e85c002cdbc9f4fcb7
SHA256

068ba29e284b53c93ac9863a037ebd038774a8ff274f0f7c059cc48e7b144ee1
SHA512

aa0b689354eda06d9ca45d1d6083e176252b8a769744b2b5e501a021093ff1c09106316a244efc48bbbb682c8fb2f0fdd54e0100cb167a1fa719cf9db4db34c1
SSDEEP

3072:VoD+5i6sQ04Zn88ak9KediUe/vhl3MegDoBzo:VoD+vkEl/IT8r

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3964	1596	WerFault.exe	89
2852	1596	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3964	1596	08e8997089abcfa8af387781fddf5dc4.exe	97
PID 1596 wrote to memory of 3964	1596	08e8997089abcfa8af387781fddf5dc4.exe	97
PID 1596 wrote to memory of 3964	1596	08e8997089abcfa8af387781fddf5dc4.exe	97

C:\Users\Admin\AppData\Local\Temp\08e8997089abcfa8af387781fddf5dc4.exe
"C:\Users\Admin\AppData\Local\Temp\08e8997089abcfa8af387781fddf5dc4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 224
  2⤵
  - Program crash
  PID:3964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 224
  2⤵
  - Program crash
  PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1596 -ip 1596
1⤵
PID:4984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1596-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download