134364df761c198825cfd17b25cb96287e84ab214492b0ddbeec494d75fe86ff | Triage

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1cbca7b43cf93eb52eed36e6df327f98.exe
Size

1.0MB
MD5

1cbca7b43cf93eb52eed36e6df327f98
SHA1

e35a17d57071b88a7687df762e1c12cabb0b99f7
SHA256

134364df761c198825cfd17b25cb96287e84ab214492b0ddbeec494d75fe86ff
SHA512

0c9ccc9741af8455ecc3b2c329cdd826024c7fff473c5c46d78734c58172b0f60bece072611a5ad7fcf6564143a3c602ad78a95d4ad6b6ca14551c9294dad4d0
SSDEEP

24576:ZcKB5s+35YZdfwcUqst2JJJmemDpGv9vlV1fr:6U29dDsRxDpGFlb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	1720	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2516	1720	1cbca7b43cf93eb52eed36e6df327f98.exe	28
PID 1720 wrote to memory of 2516	1720	1cbca7b43cf93eb52eed36e6df327f98.exe	28
PID 1720 wrote to memory of 2516	1720	1cbca7b43cf93eb52eed36e6df327f98.exe	28
PID 1720 wrote to memory of 2516	1720	1cbca7b43cf93eb52eed36e6df327f98.exe	28

C:\Users\Admin\AppData\Local\Temp\1cbca7b43cf93eb52eed36e6df327f98.exe
"C:\Users\Admin\AppData\Local\Temp\1cbca7b43cf93eb52eed36e6df327f98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 136
  2⤵
  - Program crash
  PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x0000000000140000-0x0000000000222000-memory.dmp

Filesize
904KB

Download
memory/1720-1-0x0000000000140000-0x0000000000222000-memory.dmp

Filesize
904KB

Download