b28c71a4ea9c3bc224ac689aff6df43991ef96eb1db32c9d1362f60cc2a380cb | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0cf478790ad8b55b0bcfebc0315c57b6.exe
Size

31KB
MD5

0cf478790ad8b55b0bcfebc0315c57b6
SHA1

779d8bb3248bf2f395836410ef3c4311d7505bb0
SHA256

b28c71a4ea9c3bc224ac689aff6df43991ef96eb1db32c9d1362f60cc2a380cb
SHA512

2ae6c0362c8eb43a608f97bf9f5a1c980583b828315b0c703067d81b50484f506dfd49f6689dfa16a884c42c497223713588699234ff860bea87264c4976a9fe
SSDEEP

768:CyDUoYwRVge4sUSdOAc9HLjTC9bmKx+XSeLB9:CyArwLA8UlLa9b7x+ie9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1848	1680	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1848	1680	0cf478790ad8b55b0bcfebc0315c57b6.exe	16
PID 1680 wrote to memory of 1848	1680	0cf478790ad8b55b0bcfebc0315c57b6.exe	16
PID 1680 wrote to memory of 1848	1680	0cf478790ad8b55b0bcfebc0315c57b6.exe	16
PID 1680 wrote to memory of 1848	1680	0cf478790ad8b55b0bcfebc0315c57b6.exe	16

C:\Users\Admin\AppData\Local\Temp\0cf478790ad8b55b0bcfebc0315c57b6.exe
"C:\Users\Admin\AppData\Local\Temp\0cf478790ad8b55b0bcfebc0315c57b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 36
  2⤵
  - Program crash
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-0-0x0000000013140000-0x000000001317F4C2-memory.dmp

Filesize
253KB

Download