dc556c6bf249ee1e684283a5169960aa0e4153c389d9bce85dc3fecf7d8a59e0 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:33

Sharing

Report Analysis Logs

General

Target

21dc675dd11b5c72f9f5756daa63b03f.exe
Size

31KB
MD5

21dc675dd11b5c72f9f5756daa63b03f
SHA1

85f38a0a70dbd137b3d92b93b3eea825d2dc719a
SHA256

dc556c6bf249ee1e684283a5169960aa0e4153c389d9bce85dc3fecf7d8a59e0
SHA512

fa903509eb9dabc084a31ec616cdbca2e3128a52f54a8776b2a31dbfad35210b79a99c74894afe894d6083d929ae45448529ba6f3841e7c2580f6b3bf772a4e1
SSDEEP

768:ZUh7TzTBziifTeiZSVWihwEknh0L7OTLeNfQf:eZ/nEkh8OTKN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	2224	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2112	2224	21dc675dd11b5c72f9f5756daa63b03f.exe	28
PID 2224 wrote to memory of 2112	2224	21dc675dd11b5c72f9f5756daa63b03f.exe	28
PID 2224 wrote to memory of 2112	2224	21dc675dd11b5c72f9f5756daa63b03f.exe	28
PID 2224 wrote to memory of 2112	2224	21dc675dd11b5c72f9f5756daa63b03f.exe	28

C:\Users\Admin\AppData\Local\Temp\21dc675dd11b5c72f9f5756daa63b03f.exe
"C:\Users\Admin\AppData\Local\Temp\21dc675dd11b5c72f9f5756daa63b03f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 88
  2⤵
  - Program crash
  PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download