7551363d368689f48a9fc63610412cfadd9edcb06997d5154156bef2e5cd6d74 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

133558d80f68753b7abd425ce24c8b9f.exe
Size

103KB
MD5

133558d80f68753b7abd425ce24c8b9f
SHA1

5ad8b9f9d2b7ec88b24e980ba49fbb95126768de
SHA256

7551363d368689f48a9fc63610412cfadd9edcb06997d5154156bef2e5cd6d74
SHA512

a15eb413aa213ac4506066f37a081b83088f12faf8d02163ebf396b160a4956f6737d1e1ca6aebe5dff9ba39300585243bc873f1018d2c42d3a1ee68286b1c8a
SSDEEP

3072:TZyIDJPKNcHLiK8/i+m6GHTD4WMSgQxZ1Had:Fy0JSK8/+60ssQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1640	2000	133558d80f68753b7abd425ce24c8b9f.exe	28
PID 2000 wrote to memory of 1640	2000	133558d80f68753b7abd425ce24c8b9f.exe	28
PID 2000 wrote to memory of 1640	2000	133558d80f68753b7abd425ce24c8b9f.exe	28
PID 2000 wrote to memory of 1640	2000	133558d80f68753b7abd425ce24c8b9f.exe	28

C:\Users\Admin\AppData\Local\Temp\133558d80f68753b7abd425ce24c8b9f.exe
"C:\Users\Admin\AppData\Local\Temp\133558d80f68753b7abd425ce24c8b9f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 168
  2⤵
  - Program crash
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download