77e9bd7196b7ebbb998dd604cb1d6658befc5c6bd4dcf05ab2cdab2ccb5249e3 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21ec20a7de55b871257f613620920b0f.exe
Size

98KB
MD5

21ec20a7de55b871257f613620920b0f
SHA1

e101fddc04eb5d3fd6917d6a13762f70c928063b
SHA256

77e9bd7196b7ebbb998dd604cb1d6658befc5c6bd4dcf05ab2cdab2ccb5249e3
SHA512

1d3217d5ab68dc055ee8f95b458b9a06c9935723552f75f591937d7b9ad9fa3853ee59fb6fd547262bdda7f6ae6ab4600264c1a859815147f9e5ad03c291e2fa
SSDEEP

3072:nn28gNKgnNk5IuSKbZJMysGst6L+qRht:tDgnNkDAysGaq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2420	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2756	2420	21ec20a7de55b871257f613620920b0f.exe	28
PID 2420 wrote to memory of 2756	2420	21ec20a7de55b871257f613620920b0f.exe	28
PID 2420 wrote to memory of 2756	2420	21ec20a7de55b871257f613620920b0f.exe	28
PID 2420 wrote to memory of 2756	2420	21ec20a7de55b871257f613620920b0f.exe	28

C:\Users\Admin\AppData\Local\Temp\21ec20a7de55b871257f613620920b0f.exe
"C:\Users\Admin\AppData\Local\Temp\21ec20a7de55b871257f613620920b0f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 88
  2⤵
  - Program crash
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download