41fce7293099ce27c60697e5fced7d3c2bf0c9f4925b987ced022b2b965e19ab | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 14:18

Sharing

Report Analysis Logs

General

Target

1b329895e50c2a9b7c90a83f5b28756c.exe
Size

81KB
MD5

1b329895e50c2a9b7c90a83f5b28756c
SHA1

b264eed7fc0d506c16d6cb5cc3bde5eaa6c990a0
SHA256

41fce7293099ce27c60697e5fced7d3c2bf0c9f4925b987ced022b2b965e19ab
SHA512

f1a9224b3dd687bf892636982efda7cb7e802600b8be7b99548c72e58d34c9c01edbdc9a00a154cfc898641b8864f55b3e04eafb800368fd9f603addbfb6669a
SSDEEP

1536:aRqxN/JVDZtV5wKIRyZeFnUZYQQCttWqT:P/dtV5wRyZCUZAN+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2452	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2748	2452	1b329895e50c2a9b7c90a83f5b28756c.exe	28
PID 2452 wrote to memory of 2748	2452	1b329895e50c2a9b7c90a83f5b28756c.exe	28
PID 2452 wrote to memory of 2748	2452	1b329895e50c2a9b7c90a83f5b28756c.exe	28
PID 2452 wrote to memory of 2748	2452	1b329895e50c2a9b7c90a83f5b28756c.exe	28

C:\Users\Admin\AppData\Local\Temp\1b329895e50c2a9b7c90a83f5b28756c.exe
"C:\Users\Admin\AppData\Local\Temp\1b329895e50c2a9b7c90a83f5b28756c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 132
  2⤵
  - Program crash
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads