b5ceb9096cf5202ba7c9749e66d3deb59860f2f1d47bab37b3674e1e4b80348e | Triage

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:26

Sharing

Report Analysis Logs

General

Target

0b9aac00093955d352d50abc9ded200e.exe
Size

573KB
MD5

0b9aac00093955d352d50abc9ded200e
SHA1

5c6bf1491408be19cbb88d6fb1c23d7d6b328721
SHA256

b5ceb9096cf5202ba7c9749e66d3deb59860f2f1d47bab37b3674e1e4b80348e
SHA512

9488114f9917c55a1ef5d412f17a4974f901a97ca38053586ba2fa70a5ec57a7e366858cc8bde5daefd69fd2a672e2b9de68b32a022c7dc4336c2711604b69ea
SSDEEP

12288:N80N2YDmt0LDH4dI6z/T5++fh8YarMG+Crx++Zd:NR/4ymgI8YbG+Cdj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	1984	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1268	1984	0b9aac00093955d352d50abc9ded200e.exe	29
PID 1984 wrote to memory of 1268	1984	0b9aac00093955d352d50abc9ded200e.exe	29
PID 1984 wrote to memory of 1268	1984	0b9aac00093955d352d50abc9ded200e.exe	29
PID 1984 wrote to memory of 1268	1984	0b9aac00093955d352d50abc9ded200e.exe	29

C:\Users\Admin\AppData\Local\Temp\0b9aac00093955d352d50abc9ded200e.exe
"C:\Users\Admin\AppData\Local\Temp\0b9aac00093955d352d50abc9ded200e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 136
  2⤵
  - Program crash
  PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x0000000000990000-0x0000000000A53000-memory.dmp

Filesize
780KB

Download
memory/1984-1-0x0000000000990000-0x0000000000A53000-memory.dmp

Filesize
780KB

Download
memory/1984-2-0x0000000000990000-0x0000000000A53000-memory.dmp

Filesize
780KB

Download