8597c072894bcfae39fd8b945e873ec1528b280edf67acb36f924dcfe525d189 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:27

Sharing

Report Analysis Logs

General

Target

19fe9c0e4b045b85463259c0383e8bfa.exe
Size

58KB
MD5

19fe9c0e4b045b85463259c0383e8bfa
SHA1

a51d79c0865ef8b048e5508bc0bfa8dd2db42219
SHA256

8597c072894bcfae39fd8b945e873ec1528b280edf67acb36f924dcfe525d189
SHA512

9be4c8ca4c2ae420941f7ad43d6b2da1600e20d451e08a8bdfb3b6711706dd957d2554a4c1343ddf611ffa49f2c0593638f15473d0a718b47ed1e184902e8114
SSDEEP

1536:tY10F7Qh9Q80s5By+lpJXLEhnmK6QUOtp/M/v:tk0VQ7Q80aBTlghmkS/v

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1988	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2016	1988	19fe9c0e4b045b85463259c0383e8bfa.exe	28
PID 1988 wrote to memory of 2016	1988	19fe9c0e4b045b85463259c0383e8bfa.exe	28
PID 1988 wrote to memory of 2016	1988	19fe9c0e4b045b85463259c0383e8bfa.exe	28
PID 1988 wrote to memory of 2016	1988	19fe9c0e4b045b85463259c0383e8bfa.exe	28

C:\Users\Admin\AppData\Local\Temp\19fe9c0e4b045b85463259c0383e8bfa.exe
"C:\Users\Admin\AppData\Local\Temp\19fe9c0e4b045b85463259c0383e8bfa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 36
  2⤵
  - Program crash
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download