4ac3175de610a0a0657b90b6c938bdbaa77efc099e637d50acff5be9e2eaea70 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d0752c6666055d3804287fc72870681.exe
Size

67KB
MD5

0d0752c6666055d3804287fc72870681
SHA1

537c9833b06ed1d2c7f520647537c1a6e22a5573
SHA256

4ac3175de610a0a0657b90b6c938bdbaa77efc099e637d50acff5be9e2eaea70
SHA512

e3f7bb22d32c735b52c8c9de0d525f704a674d1ec2d4ee437ad1a985d05365ffce3e701fd30a70e9e72245dda444665d1548ee393fce22a17cdc9d4c84846a7e
SSDEEP

1536:+/iahoV6hK+fsbAKg8911HgPE5FreU4+Z:+6p8hK+kk612Efr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	2860	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2320	2860	0d0752c6666055d3804287fc72870681.exe	11
PID 2860 wrote to memory of 2320	2860	0d0752c6666055d3804287fc72870681.exe	11
PID 2860 wrote to memory of 2320	2860	0d0752c6666055d3804287fc72870681.exe	11
PID 2860 wrote to memory of 2320	2860	0d0752c6666055d3804287fc72870681.exe	11

C:\Users\Admin\AppData\Local\Temp\0d0752c6666055d3804287fc72870681.exe
"C:\Users\Admin\AppData\Local\Temp\0d0752c6666055d3804287fc72870681.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 36
  2⤵
  - Program crash
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x0000000000CD0000-0x0000000000CF9000-memory.dmp

Filesize
164KB

Download