69429db70fc745378b9864474277780c40a6fb84b605d96b026b25bba4d88dbc | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:13

Sharing

Report Analysis Logs

General

Target

158c16c353a262c82d24e9527db7719d.exe
Size

24KB
MD5

158c16c353a262c82d24e9527db7719d
SHA1

beb6b1afe90b4661d9c8cee91a41972cb4ee10a2
SHA256

69429db70fc745378b9864474277780c40a6fb84b605d96b026b25bba4d88dbc
SHA512

c62a7935457f5b93ac1539c2e5ba6d4afeba476a360558a4a99d55870dc49c269e73f1551254a6171741672ddc45df5775b40db23e66207183d7f3177d954556
SSDEEP

384:jgVx2Q2CDkoTp8sjuauoAGS2S8p4z+E6hL:cVx2QJkKpdqqS78pQ+Xh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	2080	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2088	2080	158c16c353a262c82d24e9527db7719d.exe	28
PID 2080 wrote to memory of 2088	2080	158c16c353a262c82d24e9527db7719d.exe	28
PID 2080 wrote to memory of 2088	2080	158c16c353a262c82d24e9527db7719d.exe	28
PID 2080 wrote to memory of 2088	2080	158c16c353a262c82d24e9527db7719d.exe	28

C:\Users\Admin\AppData\Local\Temp\158c16c353a262c82d24e9527db7719d.exe
"C:\Users\Admin\AppData\Local\Temp\158c16c353a262c82d24e9527db7719d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 88
  2⤵
  - Program crash
  PID:2088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download