83f154b0468c9969b8e5ebd7e6c7aefb0b9a8fe839c893041610bddbaa45f5e2 | Triage

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:46

Sharing

Report Analysis Logs

General

Target

0c1bb677a665c551d21b410740822cfe.exe
Size

43KB
MD5

0c1bb677a665c551d21b410740822cfe
SHA1

2a1f4367fa1e7f6aa78912c1912c1711d73d45d5
SHA256

83f154b0468c9969b8e5ebd7e6c7aefb0b9a8fe839c893041610bddbaa45f5e2
SHA512

28020f49ed01f99dfc6209c98963ba365ed0d1b5d118496e9aeed87d276b3a1ef324a430b536d02b6a84dfecbdf3de46436f4b05ed1c97bfd9c7f5d86beae037
SSDEEP

768:P1iYZvq0orTwvgXcD6bmDzBBBywZu2z7JZ7TCyx:Nn4rogXwDlnywZu2XVx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2780	2668	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2780	2668	0c1bb677a665c551d21b410740822cfe.exe	14
PID 2668 wrote to memory of 2780	2668	0c1bb677a665c551d21b410740822cfe.exe	14
PID 2668 wrote to memory of 2780	2668	0c1bb677a665c551d21b410740822cfe.exe	14
PID 2668 wrote to memory of 2780	2668	0c1bb677a665c551d21b410740822cfe.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 88
1⤵
- Program crash
PID:2780

C:\Users\Admin\AppData\Local\Temp\0c1bb677a665c551d21b410740822cfe.exe
"C:\Users\Admin\AppData\Local\Temp\0c1bb677a665c551d21b410740822cfe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-1-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/2668-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download