6307d6ffda44c79ec6473e8a5cd0fed474c7685e1118e98698564e54286b990f | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:15

Sharing

Report Analysis Logs

General

Target

13285d99400ffc463b5545fb53ff747c.exe
Size

103KB
MD5

13285d99400ffc463b5545fb53ff747c
SHA1

451d40747045bc2499f3b8faaaccf0f3511866d1
SHA256

6307d6ffda44c79ec6473e8a5cd0fed474c7685e1118e98698564e54286b990f
SHA512

6b003609a236eaae958311af0e8df2e2d272d83cdfa168abb1a538938fc292e6a166a4b7d26879e4be35b33d8128a2e69cfeadd419af90a97a562343444c4b83
SSDEEP

3072:TZyIDJPKNcHLiK8/i+m6GHTD4WMSgQxZ13ad:Fy0JSK8/+60ssg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2300	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3048	2300	13285d99400ffc463b5545fb53ff747c.exe	28
PID 2300 wrote to memory of 3048	2300	13285d99400ffc463b5545fb53ff747c.exe	28
PID 2300 wrote to memory of 3048	2300	13285d99400ffc463b5545fb53ff747c.exe	28
PID 2300 wrote to memory of 3048	2300	13285d99400ffc463b5545fb53ff747c.exe	28

C:\Users\Admin\AppData\Local\Temp\13285d99400ffc463b5545fb53ff747c.exe
"C:\Users\Admin\AppData\Local\Temp\13285d99400ffc463b5545fb53ff747c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 168
  2⤵
  - Program crash
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download