cb51b3a6f240eaa1e464fc55c5a5f625cddf78d75447198056b506826213045d | Triage

Analysis

max time kernel
122s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:25

Sharing

Report Analysis Logs

General

Target

1b592a0a646df8c1cfa2d0d0dd4c9209.exe
Size

133KB
MD5

1b592a0a646df8c1cfa2d0d0dd4c9209
SHA1

5374c398be4a6a263c58dacdf821d4a3a7b9f711
SHA256

cb51b3a6f240eaa1e464fc55c5a5f625cddf78d75447198056b506826213045d
SHA512

4847c02c61afa02addd56a162fc3e9700b11aa06b32047f8b0025e1f27261ed0bda3f4f170e7540d6dca0237f80ffa77e618bf9dc9a2019172e1d3b317099acf
SSDEEP

3072:rHnsfvIHQ0BvzboA34LFO+Jc2/zsCy9CQ:rns3IrtPIxFIXN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	1800	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2956	1800	1b592a0a646df8c1cfa2d0d0dd4c9209.exe	28
PID 1800 wrote to memory of 2956	1800	1b592a0a646df8c1cfa2d0d0dd4c9209.exe	28
PID 1800 wrote to memory of 2956	1800	1b592a0a646df8c1cfa2d0d0dd4c9209.exe	28
PID 1800 wrote to memory of 2956	1800	1b592a0a646df8c1cfa2d0d0dd4c9209.exe	28

C:\Users\Admin\AppData\Local\Temp\1b592a0a646df8c1cfa2d0d0dd4c9209.exe
"C:\Users\Admin\AppData\Local\Temp\1b592a0a646df8c1cfa2d0d0dd4c9209.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 36
  2⤵
  - Program crash
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download