4393ee04c8c15d0d7acfe33b1503dc239cd08bafbaf7385a89cbc8b83fadfd99 | Triage

Analysis

max time kernel
174s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 00:05

Sharing

Report Analysis Logs

General

Target

07f467a840aebab3e1d4c463949c3160.exe
Size

123KB
MD5

07f467a840aebab3e1d4c463949c3160
SHA1

1c5266dbda7c125ee12fc525dc34909a3567e70d
SHA256

4393ee04c8c15d0d7acfe33b1503dc239cd08bafbaf7385a89cbc8b83fadfd99
SHA512

f1cfec08286de9b3a97215670ab6012b6fb285918ba3641181610da7bdc9aab1d4dee667531575b6ffd050c3b0e1c6fb96402cf0b0342e1b29c1a333e0fcd11a
SSDEEP

3072:UqkpRXKDA+4A0lGgmp839Q8hizNw2L03I/:0XKU+4Ay0p2z2943w

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4852	1628	WerFault.exe	88
3488	1628	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4852	1628	07f467a840aebab3e1d4c463949c3160.exe	97
PID 1628 wrote to memory of 4852	1628	07f467a840aebab3e1d4c463949c3160.exe	97
PID 1628 wrote to memory of 4852	1628	07f467a840aebab3e1d4c463949c3160.exe	97

C:\Users\Admin\AppData\Local\Temp\07f467a840aebab3e1d4c463949c3160.exe
"C:\Users\Admin\AppData\Local\Temp\07f467a840aebab3e1d4c463949c3160.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 228
  2⤵
  - Program crash
  PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 228
  2⤵
  - Program crash
  PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1628 -ip 1628
1⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1628-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download