38f9977d22500ba646c914fe7279cd236370b1d9ca56e23476608701e99bc1bc | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

14343edefe0e207cab8b93d828d5ac77.exe
Size

64KB
MD5

14343edefe0e207cab8b93d828d5ac77
SHA1

476380e3540bc30b9e97d5bed459c24f627dfcde
SHA256

38f9977d22500ba646c914fe7279cd236370b1d9ca56e23476608701e99bc1bc
SHA512

2eaa4b292b0e08563ae7c3e536b65851dc39d476e31d3e481c8782c6c182751e839bae8213dd8293cf2eee1dcff1c22c979f80619ff619959687e0d1aaf755b9
SSDEEP

1536:vmL/ODyx+/DZZoKl5TvvYkP9fQQ57lDElNOkg+A:Od+/DLoUTnYgKQLnt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2380	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2728	2380	14343edefe0e207cab8b93d828d5ac77.exe	28
PID 2380 wrote to memory of 2728	2380	14343edefe0e207cab8b93d828d5ac77.exe	28
PID 2380 wrote to memory of 2728	2380	14343edefe0e207cab8b93d828d5ac77.exe	28
PID 2380 wrote to memory of 2728	2380	14343edefe0e207cab8b93d828d5ac77.exe	28

C:\Users\Admin\AppData\Local\Temp\14343edefe0e207cab8b93d828d5ac77.exe
"C:\Users\Admin\AppData\Local\Temp\14343edefe0e207cab8b93d828d5ac77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 36
  2⤵
  - Program crash
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-0-0x0000000000170000-0x0000000000198000-memory.dmp

Filesize
160KB

Download