35664933c72627a9180e8bb7f279581d513eac6839d1e5942764e8fb8eb66233 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:53

Sharing

Report Analysis Logs

General

Target

092af0baa16e6d618ab7dd1ce9813f3b.exe
Size

644KB
MD5

092af0baa16e6d618ab7dd1ce9813f3b
SHA1

8a909cd64b0d5957addb6f58f71386ae60df8be3
SHA256

35664933c72627a9180e8bb7f279581d513eac6839d1e5942764e8fb8eb66233
SHA512

116ef82ca283e3013a9fa85398ab6ad8057cc9609851a25a6ec269ba189d7c7292d8108f8fc14d81e54fd384b10e544b5e9551aa20c59233141ccb5c872a2023
SSDEEP

12288:1xs3Sbl7yCNYo16Hfv4ZZTbsdTwgILrfs3Sbl7yCNYX:ciR7G47eQLrkiR7+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1728	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1728	092af0baa16e6d618ab7dd1ce9813f3b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2188	1728	092af0baa16e6d618ab7dd1ce9813f3b.exe	28
PID 1728 wrote to memory of 2188	1728	092af0baa16e6d618ab7dd1ce9813f3b.exe	28
PID 1728 wrote to memory of 2188	1728	092af0baa16e6d618ab7dd1ce9813f3b.exe	28
PID 1728 wrote to memory of 2188	1728	092af0baa16e6d618ab7dd1ce9813f3b.exe	28

C:\Users\Admin\AppData\Local\Temp\092af0baa16e6d618ab7dd1ce9813f3b.exe
"C:\Users\Admin\AppData\Local\Temp\092af0baa16e6d618ab7dd1ce9813f3b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 188
  2⤵
  - Program crash
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads