87d2a301ad5a7bcdfe63e79f3ec4e44697a0a3e51c8276b34519f09b4a665455 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:52

Sharing

Report Analysis Logs

General

Target

0922ff4d0190ed1ddc769af71b36f76c.exe
Size

124KB
MD5

0922ff4d0190ed1ddc769af71b36f76c
SHA1

bb7d884c1549e2aad28978e0b5efe75ca2e47e83
SHA256

87d2a301ad5a7bcdfe63e79f3ec4e44697a0a3e51c8276b34519f09b4a665455
SHA512

e6ad23a72381f706109dc229e23fe61d41db13232bdde6fdeafcae542abd77e364af14517367dfc61ee4426caaa0c2270503117ab3d42c79950911e740564282
SSDEEP

3072:yshPC1Nn2eoEbehSgC8w/iCCb4lKWnuQ/vMU8Yoew:dKSEbvgCzxAitExYM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	3044	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2928	3044	0922ff4d0190ed1ddc769af71b36f76c.exe	28
PID 3044 wrote to memory of 2928	3044	0922ff4d0190ed1ddc769af71b36f76c.exe	28
PID 3044 wrote to memory of 2928	3044	0922ff4d0190ed1ddc769af71b36f76c.exe	28
PID 3044 wrote to memory of 2928	3044	0922ff4d0190ed1ddc769af71b36f76c.exe	28

C:\Users\Admin\AppData\Local\Temp\0922ff4d0190ed1ddc769af71b36f76c.exe
"C:\Users\Admin\AppData\Local\Temp\0922ff4d0190ed1ddc769af71b36f76c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 36
  2⤵
  - Program crash
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3044-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download