e67f5dd96a641e41642c1d348713373f810ae126d2dfb8f8d8c37e60f000457c | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:32

Sharing

Report Analysis Logs

General

Target

16024a6995502539c3a8f90a537f272d.exe
Size

123KB
MD5

16024a6995502539c3a8f90a537f272d
SHA1

097ffdfcecd62ace7ca240081462a5425d057d4e
SHA256

e67f5dd96a641e41642c1d348713373f810ae126d2dfb8f8d8c37e60f000457c
SHA512

07222766008fb17e39f816582ea86d81a028d9caa5abcfb29fca21fc0ee6324ab4a4020764e60863c3b3811c5251dd33f6d6f325b3f24cb8eab475573986c69d
SSDEEP

3072:I3nDGcneOAhW53sKgnmx1TtPcC29TC4hR:oGcebE5qmTc19TPR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	2040	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2008	2040	16024a6995502539c3a8f90a537f272d.exe	28
PID 2040 wrote to memory of 2008	2040	16024a6995502539c3a8f90a537f272d.exe	28
PID 2040 wrote to memory of 2008	2040	16024a6995502539c3a8f90a537f272d.exe	28
PID 2040 wrote to memory of 2008	2040	16024a6995502539c3a8f90a537f272d.exe	28

C:\Users\Admin\AppData\Local\Temp\16024a6995502539c3a8f90a537f272d.exe
"C:\Users\Admin\AppData\Local\Temp\16024a6995502539c3a8f90a537f272d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 36
  2⤵
  - Program crash
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2040-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download