e67b824d3ed82e69e425cc55042b6baa3bb2aefe6b3218dfcfecd9b6b8b264b2 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:14

Sharing

Report Analysis Logs

General

Target

158ddeae9479db82f6bfda4e6763add4.exe
Size

37KB
MD5

158ddeae9479db82f6bfda4e6763add4
SHA1

b409bb925440d827592c1872b0f23034f4b7d2f8
SHA256

e67b824d3ed82e69e425cc55042b6baa3bb2aefe6b3218dfcfecd9b6b8b264b2
SHA512

df1420f80c1478a5ba6d52fc4e2a6d46fcc10ad9b80426ff05722d6aea9c2d9d6912bcc81e1d53adff87a03c6ee0066f70877587f959569acf491cac51ed1215
SSDEEP

768:2U2W6w/bFp+j+z5Pf7vsgHMsCBntS2bc4bnLb:2URbv+Kzl7vt2tln

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1388	2956	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1388	2956	158ddeae9479db82f6bfda4e6763add4.exe	16
PID 2956 wrote to memory of 1388	2956	158ddeae9479db82f6bfda4e6763add4.exe	16
PID 2956 wrote to memory of 1388	2956	158ddeae9479db82f6bfda4e6763add4.exe	16
PID 2956 wrote to memory of 1388	2956	158ddeae9479db82f6bfda4e6763add4.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 36
1⤵
- Program crash
PID:1388

C:\Users\Admin\AppData\Local\Temp\158ddeae9479db82f6bfda4e6763add4.exe
"C:\Users\Admin\AppData\Local\Temp\158ddeae9479db82f6bfda4e6763add4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download