a595e4143c84070697f3dd72517c43c22ca62755859f5587cee64dfe012d68be | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b77d02e76aa9d0fa4f1dc826e8ff917.exe
Size

109KB
MD5

1b77d02e76aa9d0fa4f1dc826e8ff917
SHA1

d4ec10c8a83cc2df980948c0fb74fa937e56f45c
SHA256

a595e4143c84070697f3dd72517c43c22ca62755859f5587cee64dfe012d68be
SHA512

d42e9557f958375a573e90c3fb50bcaba50f77a45ba167213d9a50b0cd2c1f6a0b3bbd6b6c4cb3e1c1bbb0958b3ee77cd49544481de6e89d8f794307fde8ecdc
SSDEEP

3072:Y1LLj5juQhJ/4/p9RRqC8WXhBguDaFzzIvUE:Y1z4QU/XCSBguDaFa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2148	2364	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2148	2364	1b77d02e76aa9d0fa4f1dc826e8ff917.exe	28
PID 2364 wrote to memory of 2148	2364	1b77d02e76aa9d0fa4f1dc826e8ff917.exe	28
PID 2364 wrote to memory of 2148	2364	1b77d02e76aa9d0fa4f1dc826e8ff917.exe	28
PID 2364 wrote to memory of 2148	2364	1b77d02e76aa9d0fa4f1dc826e8ff917.exe	28

C:\Users\Admin\AppData\Local\Temp\1b77d02e76aa9d0fa4f1dc826e8ff917.exe
"C:\Users\Admin\AppData\Local\Temp\1b77d02e76aa9d0fa4f1dc826e8ff917.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 36
  2⤵
  - Program crash
  PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download