acf7878b768e37456c01f6f2375cdb4d661d9341efeaea0b70b7d82ca8c315a1 | Triage

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11bc8606b2dadb7a0b7a027e15a640cb.exe
Size

62KB
MD5

11bc8606b2dadb7a0b7a027e15a640cb
SHA1

7aa045a00e4e45cc4fa4568bc14bdb59c6bf916b
SHA256

acf7878b768e37456c01f6f2375cdb4d661d9341efeaea0b70b7d82ca8c315a1
SHA512

238a468a090042c06ef613b7e266b1c0d76b3f22f25e16be2a478b8546662e45d757d07f9b981746669f2a3913ff34667c2497481f4c9b5b7a39945d215ce92b
SSDEEP

1536:6sr8n2dXSAxKJenO5RX54VtAx7u4x2Mq:6h2lSAx8eOf54V2x7y

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1384	2544	WerFault.exe	83
1896	2544	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1384	2544	11bc8606b2dadb7a0b7a027e15a640cb.exe	90
PID 2544 wrote to memory of 1384	2544	11bc8606b2dadb7a0b7a027e15a640cb.exe	90
PID 2544 wrote to memory of 1384	2544	11bc8606b2dadb7a0b7a027e15a640cb.exe	90

C:\Users\Admin\AppData\Local\Temp\11bc8606b2dadb7a0b7a027e15a640cb.exe
"C:\Users\Admin\AppData\Local\Temp\11bc8606b2dadb7a0b7a027e15a640cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 508
  2⤵
  - Program crash
  PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 508
  2⤵
  - Program crash
  PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2544 -ip 2544
1⤵
PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2544-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download