671687efe1d83eaa1f4d5f497a51abf8c08f515b5c666d0385c830c5122fd43b | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:25

Sharing

Report Analysis Logs

General

Target

135a57e5cb301a440e9607657ccdbec0.exe
Size

24KB
MD5

135a57e5cb301a440e9607657ccdbec0
SHA1

3ee311e39ff2b0eb9e2489d56c067fb5065c251a
SHA256

671687efe1d83eaa1f4d5f497a51abf8c08f515b5c666d0385c830c5122fd43b
SHA512

3bb3e4ba992f0151d620ee6aa271ed5cff617a1f4943c953e0b3a5887e2ab26c27868c17746e2a3742931fb19bc214fc6fb53dfa20f9007013e97ea5fe0a9a58
SSDEEP

768:+Txu31RAkB5sRr5/SCgrGiQ326ioEIwoq2roFlD9w:GE1RAtlq826Z9rUw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	3044	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1728	3044	135a57e5cb301a440e9607657ccdbec0.exe	16
PID 3044 wrote to memory of 1728	3044	135a57e5cb301a440e9607657ccdbec0.exe	16
PID 3044 wrote to memory of 1728	3044	135a57e5cb301a440e9607657ccdbec0.exe	16
PID 3044 wrote to memory of 1728	3044	135a57e5cb301a440e9607657ccdbec0.exe	16

C:\Users\Admin\AppData\Local\Temp\135a57e5cb301a440e9607657ccdbec0.exe
"C:\Users\Admin\AppData\Local\Temp\135a57e5cb301a440e9607657ccdbec0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 88
  2⤵
  - Program crash
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download