71f482af0b9fe0edb520f2d38d7e726c195e1d4c5c3b9fd1cdbbe779fb3651c0 | Triage

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 04:25

Sharing

Report Analysis Logs

General

Target

0e63ec742efeddb8b46af710cc9db493.exe
Size

360KB
MD5

0e63ec742efeddb8b46af710cc9db493
SHA1

c31a9458e3e374bb439a6e0d1cb444f549a46bf7
SHA256

71f482af0b9fe0edb520f2d38d7e726c195e1d4c5c3b9fd1cdbbe779fb3651c0
SHA512

ad2805f20cfa702f638147b52d85c4495f319a3d746cf0aadcb9dbf00a74da462f83a0b776e7e7e314c8a2f67d9c1bb806a75cae3a98e47409b7668c4c70f9ea
SSDEEP

6144:Whje3IfIS7BXlEFPWk4zYXHoMsfMfVcqSCZUCL:WFeYfbBXeFeDzwoU9clCZUq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	1616	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1516	1616	0e63ec742efeddb8b46af710cc9db493.exe	28
PID 1616 wrote to memory of 1516	1616	0e63ec742efeddb8b46af710cc9db493.exe	28
PID 1616 wrote to memory of 1516	1616	0e63ec742efeddb8b46af710cc9db493.exe	28
PID 1616 wrote to memory of 1516	1616	0e63ec742efeddb8b46af710cc9db493.exe	28

C:\Users\Admin\AppData\Local\Temp\0e63ec742efeddb8b46af710cc9db493.exe
"C:\Users\Admin\AppData\Local\Temp\0e63ec742efeddb8b46af710cc9db493.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 96
  2⤵
  - Program crash
  PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-0-0x0000000000400000-0x0000000000691000-memory.dmp

Filesize
2.6MB

Download