8ae9905498221a4c8ae3198bba700836abfdda31d8e739dbfca0bb7a7f6687b4 | Triage

Analysis

max time kernel
142s
max time network
26s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:47

Sharing

Report Analysis Logs

General

Target

251231a2a9e1fa46c6ef684e37bf340e.exe
Size

10KB
MD5

251231a2a9e1fa46c6ef684e37bf340e
SHA1

c33af4823c0740f5513517f63e7a2f1a6f404141
SHA256

8ae9905498221a4c8ae3198bba700836abfdda31d8e739dbfca0bb7a7f6687b4
SHA512

cbd34a313360dfdb7e3f6796fd0b0d0afaf254f6c08a9001f15700d735b30938577ad3fd960dbd15a0da28aa95e5fea5dab1f250a01ea7b6686d5d2382620dec
SSDEEP

192:oik8ivv038Nx/78yzyr/7J/+Oser51eq3B:47veiTjIB+wr5z3B

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	1956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2472	1956	251231a2a9e1fa46c6ef684e37bf340e.exe	28
PID 1956 wrote to memory of 2472	1956	251231a2a9e1fa46c6ef684e37bf340e.exe	28
PID 1956 wrote to memory of 2472	1956	251231a2a9e1fa46c6ef684e37bf340e.exe	28
PID 1956 wrote to memory of 2472	1956	251231a2a9e1fa46c6ef684e37bf340e.exe	28

C:\Users\Admin\AppData\Local\Temp\251231a2a9e1fa46c6ef684e37bf340e.exe
"C:\Users\Admin\AppData\Local\Temp\251231a2a9e1fa46c6ef684e37bf340e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 36
  2⤵
  - Program crash
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download