9649ae8a896c3faedd9969ea68337418458dd75364102e39d11219525e57980d | Triage

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:29

Sharing

Report Analysis Logs

General

Target

0baf44782522b27b8b35d5df9adf9423.exe
Size

59KB
MD5

0baf44782522b27b8b35d5df9adf9423
SHA1

5f6dcac880c70cf9eaf22f89ff950f083d704110
SHA256

9649ae8a896c3faedd9969ea68337418458dd75364102e39d11219525e57980d
SHA512

4bfd917de9943e9e77a203f94a3330ba88bd1d5cc3c4c30ab08a012424d7ef4b209f9b1de996232fc325abd253c6fe0f5ce544e71164b08dab9c153c4532e73b
SSDEEP

1536:K9YB52C7tbeKwOBHies0NoFs3YFPneexSs6N:K+B52C1fwYHies0NoWQxR6N

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2108	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2224	2108	0baf44782522b27b8b35d5df9adf9423.exe	28
PID 2108 wrote to memory of 2224	2108	0baf44782522b27b8b35d5df9adf9423.exe	28
PID 2108 wrote to memory of 2224	2108	0baf44782522b27b8b35d5df9adf9423.exe	28
PID 2108 wrote to memory of 2224	2108	0baf44782522b27b8b35d5df9adf9423.exe	28

C:\Users\Admin\AppData\Local\Temp\0baf44782522b27b8b35d5df9adf9423.exe
"C:\Users\Admin\AppData\Local\Temp\0baf44782522b27b8b35d5df9adf9423.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 88
  2⤵
  - Program crash
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-0-0x0000000020000000-0x000000002000E200-memory.dmp

Filesize
56KB

Download