49d9dd6b127f7a87437826643f96ee216b8cd3b8ddb6e17032c365cbea6fe2e0 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e1a5352020507ae322cfa19ec3261f9.exe
Size

125KB
MD5

0e1a5352020507ae322cfa19ec3261f9
SHA1

6ca5ac4bb276bea612f0e92fe9bebf72613cd915
SHA256

49d9dd6b127f7a87437826643f96ee216b8cd3b8ddb6e17032c365cbea6fe2e0
SHA512

d41a64bf610c7ed21f7910d65c7e597d5dc33dfc96a95e14dffd009b3c6c502b8a3aee7f344c20b13afe6fde7a90c9afe03b4d82c38ffab189c812510b69a409
SSDEEP

3072:1HqvrZ9FXQQgptLcoOJYWhA+/eC2OWtH5oFAFZ8:FyrbFbgpNco0zVWNnDS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2444	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2672	2444	0e1a5352020507ae322cfa19ec3261f9.exe	28
PID 2444 wrote to memory of 2672	2444	0e1a5352020507ae322cfa19ec3261f9.exe	28
PID 2444 wrote to memory of 2672	2444	0e1a5352020507ae322cfa19ec3261f9.exe	28
PID 2444 wrote to memory of 2672	2444	0e1a5352020507ae322cfa19ec3261f9.exe	28

C:\Users\Admin\AppData\Local\Temp\0e1a5352020507ae322cfa19ec3261f9.exe
"C:\Users\Admin\AppData\Local\Temp\0e1a5352020507ae322cfa19ec3261f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 36
  2⤵
  - Program crash
  PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2444-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download