494cb2138c6136f32fea77c9522e4c8734de8686f4c2a992b4b797b5a4d140a7 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:39

Sharing

Report Analysis Logs

General

Target

1142d5d091a082ecbef7759a97a91ea4.exe
Size

219KB
MD5

1142d5d091a082ecbef7759a97a91ea4
SHA1

b9f9bff4a232491323008e591cd5c22ebbbaa3a2
SHA256

494cb2138c6136f32fea77c9522e4c8734de8686f4c2a992b4b797b5a4d140a7
SHA512

a4f232544a1a338404577fc435d0bfd0b74b2d8d118010889060a70ec0ed36ae00c8b31efb0aa802af19342fab1765e5a35e4e36b3b4a61cb0d52cc6523af773
SSDEEP

6144:mnkHk3yPobrtndmu4vBDpFEVKZ7q3KUmboRFGRw8:mnAYeobXOvBNuorsRFGm8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2992	1728	1142d5d091a082ecbef7759a97a91ea4.exe	28
PID 1728 wrote to memory of 2992	1728	1142d5d091a082ecbef7759a97a91ea4.exe	28
PID 1728 wrote to memory of 2992	1728	1142d5d091a082ecbef7759a97a91ea4.exe	28
PID 1728 wrote to memory of 2992	1728	1142d5d091a082ecbef7759a97a91ea4.exe	28

C:\Users\Admin\AppData\Local\Temp\1142d5d091a082ecbef7759a97a91ea4.exe
"C:\Users\Admin\AppData\Local\Temp\1142d5d091a082ecbef7759a97a91ea4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 84
  2⤵
  - Program crash
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads