4b43a3bd1c644abb547709dc8e1a4d45b4ee7e5d50121c0e3e030d28742b345e | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

19c160d5ff5d54d08edbe95d22f8d09f.exe
Size

124KB
MD5

19c160d5ff5d54d08edbe95d22f8d09f
SHA1

1332ca53cf86e0ef0d6623fc45a52c88c6613c9b
SHA256

4b43a3bd1c644abb547709dc8e1a4d45b4ee7e5d50121c0e3e030d28742b345e
SHA512

d6c2c472d0c4e5fde45cd56c5a527c5c4348aea51ea7fe7494e5f76c7dceb3817397f4cf5d46a55c13161cc6f8bbe176e6d294c7ae3fd206a8470cc2e9271a2a
SSDEEP

3072:Vn3Af1X75ziRCcx0sM30QKEN7rIlL7mjBJx9:Nwf1L5zs5MEJENQmBr9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2964	2196	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2964	2196	19c160d5ff5d54d08edbe95d22f8d09f.exe	14
PID 2196 wrote to memory of 2964	2196	19c160d5ff5d54d08edbe95d22f8d09f.exe	14
PID 2196 wrote to memory of 2964	2196	19c160d5ff5d54d08edbe95d22f8d09f.exe	14
PID 2196 wrote to memory of 2964	2196	19c160d5ff5d54d08edbe95d22f8d09f.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 36
1⤵
- Program crash
PID:2964

C:\Users\Admin\AppData\Local\Temp\19c160d5ff5d54d08edbe95d22f8d09f.exe
"C:\Users\Admin\AppData\Local\Temp\19c160d5ff5d54d08edbe95d22f8d09f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download