588f959b0c66caead3d9e7889628db7588a5bb270e37e8f1b5ad08bbfb63b44d | Triage

Analysis

max time kernel
136s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:59

Sharing

Report Analysis Logs

General

Target

152efc558104a84848a6b1ac43f5bd11.exe
Size

28KB
MD5

152efc558104a84848a6b1ac43f5bd11
SHA1

7d5376439fb91001fc8d2b8c0b5dc3c8d937baaf
SHA256

588f959b0c66caead3d9e7889628db7588a5bb270e37e8f1b5ad08bbfb63b44d
SHA512

85fe54b9ae164d062691aab66677ae2b9ee0a7cd3b217bc5f5b3583e8f2014676bca8d047f5059ec131e37664785bfc96f09e8296529d6431ad738c9078c4011
SSDEEP

384:9XIc8R65DT4No1KEjhMRXKRgDGST0sEL:9swtT4KjhGDr1

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3264	4588	WerFault.exe	89
1160	4588	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3264	4588	152efc558104a84848a6b1ac43f5bd11.exe	95
PID 4588 wrote to memory of 3264	4588	152efc558104a84848a6b1ac43f5bd11.exe	95
PID 4588 wrote to memory of 3264	4588	152efc558104a84848a6b1ac43f5bd11.exe	95

C:\Users\Admin\AppData\Local\Temp\152efc558104a84848a6b1ac43f5bd11.exe
"C:\Users\Admin\AppData\Local\Temp\152efc558104a84848a6b1ac43f5bd11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 408
  2⤵
  - Program crash
  PID:3264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 408
  2⤵
  - Program crash
  PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4588 -ip 4588
1⤵
PID:3232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads