2d5dac20fb9142588368dfd2b964c0505fffc73f3908e2a2afa06818986e44e7 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:54

Sharing

Report Analysis Logs

General

Target

0933c9bdb148599b4c5209ac6ca75f7d.exe
Size

25KB
MD5

0933c9bdb148599b4c5209ac6ca75f7d
SHA1

f90a736b9870f23d8da1c472558faf25a30d2e3b
SHA256

2d5dac20fb9142588368dfd2b964c0505fffc73f3908e2a2afa06818986e44e7
SHA512

656613ee82639b59e1e59d21d3734423ea3de85ae80917dc36d3025d8b339984fbede3e77f94ea7757aad8681d77b0fcc34b51f02202012744dbd9dd7d78c76e
SSDEEP

768:O/e5GzlICsaB8PEcjalKF8tFaZWV0pZtTh:O/hzlIo8PiVt7SpZp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1756	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2188	1756	0933c9bdb148599b4c5209ac6ca75f7d.exe	28
PID 1756 wrote to memory of 2188	1756	0933c9bdb148599b4c5209ac6ca75f7d.exe	28
PID 1756 wrote to memory of 2188	1756	0933c9bdb148599b4c5209ac6ca75f7d.exe	28
PID 1756 wrote to memory of 2188	1756	0933c9bdb148599b4c5209ac6ca75f7d.exe	28

C:\Users\Admin\AppData\Local\Temp\0933c9bdb148599b4c5209ac6ca75f7d.exe
"C:\Users\Admin\AppData\Local\Temp\0933c9bdb148599b4c5209ac6ca75f7d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 36
  2⤵
  - Program crash
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-0-0x0000000013140000-0x0000000013178000-memory.dmp

Filesize
224KB

Download