af1f8fa99b8c1fed0b559b5741d42d3804add811517082800fa15c22a9aa8874 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:10

Sharing

Report Analysis Logs

General

Target

18198393aae1df5bb0dc3ae1f6e3a135.exe
Size

114KB
MD5

18198393aae1df5bb0dc3ae1f6e3a135
SHA1

560e72efbf4e177547cb9f83a32a53821c8cb30f
SHA256

af1f8fa99b8c1fed0b559b5741d42d3804add811517082800fa15c22a9aa8874
SHA512

3c82048566d520467d508ae058c21b8ea5f0fafcc136d11c39f2f1588b5ec70b31065e323fe1372b3eddfdab578f7aa7ff7fe9c867e7c66f7b5873e18ab1e522
SSDEEP

3072:ZNay6EH01fKoNSoAbKCvd3xiv+twpozPvhniPc8M:9H0dKtbHvd3U+tzb5WM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	2072	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2156	2072	18198393aae1df5bb0dc3ae1f6e3a135.exe	28
PID 2072 wrote to memory of 2156	2072	18198393aae1df5bb0dc3ae1f6e3a135.exe	28
PID 2072 wrote to memory of 2156	2072	18198393aae1df5bb0dc3ae1f6e3a135.exe	28
PID 2072 wrote to memory of 2156	2072	18198393aae1df5bb0dc3ae1f6e3a135.exe	28

C:\Users\Admin\AppData\Local\Temp\18198393aae1df5bb0dc3ae1f6e3a135.exe
"C:\Users\Admin\AppData\Local\Temp\18198393aae1df5bb0dc3ae1f6e3a135.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 36
  2⤵
  - Program crash
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2072-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download