77f352731f0f54e5829732596dd976afaa5a48d97339b4f548049fd101ab3ccd | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:17

Sharing

Report Analysis Logs

General

Target

21666191b9487673714d692a37ad35de.exe
Size

41KB
MD5

21666191b9487673714d692a37ad35de
SHA1

aa583c6809d83baaed15dd1a14a102abc8a486d9
SHA256

77f352731f0f54e5829732596dd976afaa5a48d97339b4f548049fd101ab3ccd
SHA512

b51e573d9783c4171e98f2d4d9bdca1f64a8d35ce5cd16736ac662e9dd55ad5f299f7e3b8127d0e4912c59998e7ee037a9773e5535201f464f61a71616e7fd79
SSDEEP

768:Dh2toqSvpTXnztLNMNdyekLGHEfT+qXyf:Dh9DZtLeeyqXa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1736	2060	21666191b9487673714d692a37ad35de.exe	28
PID 2060 wrote to memory of 1736	2060	21666191b9487673714d692a37ad35de.exe	28
PID 2060 wrote to memory of 1736	2060	21666191b9487673714d692a37ad35de.exe	28
PID 2060 wrote to memory of 1736	2060	21666191b9487673714d692a37ad35de.exe	28

C:\Users\Admin\AppData\Local\Temp\21666191b9487673714d692a37ad35de.exe
"C:\Users\Admin\AppData\Local\Temp\21666191b9487673714d692a37ad35de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 100
  2⤵
  - Program crash
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads