77befc03b94e37a7e40ffbf61a852bcfac475d86b52eb5101d336795449b93cb | Triage

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:23

Sharing

Report Analysis Logs

General

Target

0b8550202baf83981cbdcf7c8550212c.exe
Size

69KB
MD5

0b8550202baf83981cbdcf7c8550212c
SHA1

0c3d4a3c39fbd9578f45a4b6ed067c569327472e
SHA256

77befc03b94e37a7e40ffbf61a852bcfac475d86b52eb5101d336795449b93cb
SHA512

a649e15878bc9c8fe60801f6369132a941aaad099068d9bff37c910f39562b9af828feac9b9d692437b0e0b95b16dd442e98ff1a3d7d5631596d22b3d01e488f
SSDEEP

1536:dCxg9+5Tf9uDNSQ85GdSu6lvcHUQXlfGGF9K0:f9+ZfYBMGdSuM0HUSfGGFE0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	1900	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2644	1900	0b8550202baf83981cbdcf7c8550212c.exe	28
PID 1900 wrote to memory of 2644	1900	0b8550202baf83981cbdcf7c8550212c.exe	28
PID 1900 wrote to memory of 2644	1900	0b8550202baf83981cbdcf7c8550212c.exe	28
PID 1900 wrote to memory of 2644	1900	0b8550202baf83981cbdcf7c8550212c.exe	28

C:\Users\Admin\AppData\Local\Temp\0b8550202baf83981cbdcf7c8550212c.exe
"C:\Users\Admin\AppData\Local\Temp\0b8550202baf83981cbdcf7c8550212c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 88
  2⤵
  - Program crash
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1900-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download