25a1ed638307b5c361a117048961fffb5533a2925553a2cb44ae61fc5389c23e | Triage

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:17

Sharing

Report Analysis Logs

General

Target

10.exe
Size

23KB
MD5

7d37085597cbb581e7f16f3ce86704f7
SHA1

7d2105b07c191eb59aeb9b79d1381eeebb5da634
SHA256

2fec88c49d917361318ba9b844ed2ef24e9bfef5522308b2438dc4b5e36f1253
SHA512

2aaf2cccf09a47a872f0373a8bb48e9d694192238ac26a5df22e4cc41c0ee2246748ccfa5577ee387700131f497bceb7729dc6b927695501344fb9b87a7963ca
SSDEEP

384:FwA6K73YQaBM5oFIyduoqCG1L4gzjAzk6KuJrGSE5p7Hlv:FamIQaBioFIauoqCWQvBE5pzlv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2164	2616	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2164	2616	10.exe	14
PID 2616 wrote to memory of 2164	2616	10.exe	14
PID 2616 wrote to memory of 2164	2616	10.exe	14
PID 2616 wrote to memory of 2164	2616	10.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 36
1⤵
- Program crash
PID:2164

C:\Users\Admin\AppData\Local\Temp\10.exe
"C:\Users\Admin\AppData\Local\Temp\10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2616-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download