41a2fa8c658a50867996adc8a86ed6dbd848ec42ae370d0c3a3d2d24ebceef72 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:03

Sharing

Report Analysis Logs

General

Target

07e961cc3ff3134c2082d37212c83aed.exe
Size

2KB
MD5

07e961cc3ff3134c2082d37212c83aed
SHA1

0e990ebd4cef85956352e362a5cddf5b74a59148
SHA256

41a2fa8c658a50867996adc8a86ed6dbd848ec42ae370d0c3a3d2d24ebceef72
SHA512

beb35333a1b1613024f3373d01ec001fb5a44c2e0cdaf46203b5c9c8c0873cf8825c300514dc0568ade90ebf2d691822d84554ef858a26ba5c6ea142cb379d0c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	2868	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2896	2868	07e961cc3ff3134c2082d37212c83aed.exe	11
PID 2868 wrote to memory of 2896	2868	07e961cc3ff3134c2082d37212c83aed.exe	11
PID 2868 wrote to memory of 2896	2868	07e961cc3ff3134c2082d37212c83aed.exe	11
PID 2868 wrote to memory of 2896	2868	07e961cc3ff3134c2082d37212c83aed.exe	11

C:\Users\Admin\AppData\Local\Temp\07e961cc3ff3134c2082d37212c83aed.exe
"C:\Users\Admin\AppData\Local\Temp\07e961cc3ff3134c2082d37212c83aed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 36
  2⤵
  - Program crash
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads