015628a499dbcb8756cd1512b4afd4b566325ac7b6b987732809f7fe0813c6b7 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:00

Sharing

Report Analysis Logs

General

Target

108feca9855885ed25afdb85cfeab4c2.exe
Size

121KB
MD5

108feca9855885ed25afdb85cfeab4c2
SHA1

843e3e7722db199d146879b456e8c1699789c3f4
SHA256

015628a499dbcb8756cd1512b4afd4b566325ac7b6b987732809f7fe0813c6b7
SHA512

c765571f73675c44d2f7900a9a3e83f304be0d8b23548f07d2e7f923a072b97b0225cba12832380bb37e2ec1e287e0ef020c8a8efba9e9337512fa12f897595a
SSDEEP

3072:noAzA2XyEV3npw9Aqwq3mYwLkSettid6Ut0sRIlWp:9AIyEHAJtm7k1tST9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1692	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1936	1692	108feca9855885ed25afdb85cfeab4c2.exe	15
PID 1692 wrote to memory of 1936	1692	108feca9855885ed25afdb85cfeab4c2.exe	15
PID 1692 wrote to memory of 1936	1692	108feca9855885ed25afdb85cfeab4c2.exe	15
PID 1692 wrote to memory of 1936	1692	108feca9855885ed25afdb85cfeab4c2.exe	15

C:\Users\Admin\AppData\Local\Temp\108feca9855885ed25afdb85cfeab4c2.exe
"C:\Users\Admin\AppData\Local\Temp\108feca9855885ed25afdb85cfeab4c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 36
  2⤵
  - Program crash
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1692-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download