fd76df0696fa2fb4b69734a5b7bebcda83ecbcf1b4413c4033a850d3ab5b05e4 | Triage

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:16

Sharing

Report Analysis Logs

General

Target

133069634de0867650a9b076172fba34.exe
Size

80KB
MD5

133069634de0867650a9b076172fba34
SHA1

6b2baf9a34647215269cdf99b21a0b51a38296b3
SHA256

fd76df0696fa2fb4b69734a5b7bebcda83ecbcf1b4413c4033a850d3ab5b05e4
SHA512

b3fa09fbb154c0b2fcf8e1d79b357b7a85b4fb4ceeb7be6899e9347ce4370f38417a0ec64c0c5ff980d1a222d28df1f042bfe5dab033e7a42c99085ebe9a8512
SSDEEP

1536:LDwrDuZY2lY2Ymy98YfYjBJx/p+J/HyzUXRmjh0V:LMrDoYKyzfgrx/2XR8hM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2752	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2800	2752	133069634de0867650a9b076172fba34.exe	20
PID 2752 wrote to memory of 2800	2752	133069634de0867650a9b076172fba34.exe	20
PID 2752 wrote to memory of 2800	2752	133069634de0867650a9b076172fba34.exe	20
PID 2752 wrote to memory of 2800	2752	133069634de0867650a9b076172fba34.exe	20

C:\Users\Admin\AppData\Local\Temp\133069634de0867650a9b076172fba34.exe
"C:\Users\Admin\AppData\Local\Temp\133069634de0867650a9b076172fba34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 92
  2⤵
  - Program crash
  PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads