eece1e9c38aada847fcf97757865b20f1be4168e05fd97424ecbf1e92141e201 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:33

Sharing

Report Analysis Logs

General

Target

0a2e0704a26d489b1b6549dc82f2d805.exe
Size

39KB
MD5

0a2e0704a26d489b1b6549dc82f2d805
SHA1

ead7c2b3fe6407d4c967c3174d10095c5766bad9
SHA256

eece1e9c38aada847fcf97757865b20f1be4168e05fd97424ecbf1e92141e201
SHA512

2a0ab34b24acf1a595ff1f7dc9e1097e8160d8c7e57cbfff77f6794c6fc3e3be1d3f7f92fae11dc7a6cd0f786f5d38eb27c4119722c2e738cac3e18acf20d4cf
SSDEEP

768:afr6USD789dee7YBI5QXsltGWKNmMBWIYPn8:afOUSD7M7lE50MQn8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
400	2988	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 400	2988	0a2e0704a26d489b1b6549dc82f2d805.exe	16
PID 2988 wrote to memory of 400	2988	0a2e0704a26d489b1b6549dc82f2d805.exe	16
PID 2988 wrote to memory of 400	2988	0a2e0704a26d489b1b6549dc82f2d805.exe	16
PID 2988 wrote to memory of 400	2988	0a2e0704a26d489b1b6549dc82f2d805.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 88
1⤵
- Program crash
PID:400

C:\Users\Admin\AppData\Local\Temp\0a2e0704a26d489b1b6549dc82f2d805.exe
"C:\Users\Admin\AppData\Local\Temp\0a2e0704a26d489b1b6549dc82f2d805.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-1-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2988-0-0x0000000000400000-0x0000000000410F37-memory.dmp

Filesize
67KB

Download