990fda25e1122320921d567821a1e317f5102e7d8dbfce62ee0cb76d47d25dc6 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:21

Sharing

Report Analysis Logs

General

Target

1bbf273ae8020987d190acc9e8bcf5fd.exe
Size

76KB
MD5

1bbf273ae8020987d190acc9e8bcf5fd
SHA1

0ad9c1254962ee75653be238c7af079c3a4a6513
SHA256

990fda25e1122320921d567821a1e317f5102e7d8dbfce62ee0cb76d47d25dc6
SHA512

9bc8e8b4fc595d521e00086d2e452039a90c45b46589ab2f7e4b46f1526e8b1419b68670c064fb9753bb56389ae987bb5e7a827f98e064e5f8c49b68006254b0
SSDEEP

1536:+yidZ95yqW2YuTZc6V1essWjcdfNDD09we:+yzh2zDVmfNv09

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	2232	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2368	2232	1bbf273ae8020987d190acc9e8bcf5fd.exe	28
PID 2232 wrote to memory of 2368	2232	1bbf273ae8020987d190acc9e8bcf5fd.exe	28
PID 2232 wrote to memory of 2368	2232	1bbf273ae8020987d190acc9e8bcf5fd.exe	28
PID 2232 wrote to memory of 2368	2232	1bbf273ae8020987d190acc9e8bcf5fd.exe	28

C:\Users\Admin\AppData\Local\Temp\1bbf273ae8020987d190acc9e8bcf5fd.exe
"C:\Users\Admin\AppData\Local\Temp\1bbf273ae8020987d190acc9e8bcf5fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 116
  2⤵
  - Program crash
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads