8e1ba692294954ec47d7152683b618be994a6b4ffc583aa341c42cb5ae3d5cf3 | Triage

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:07

Sharing

Report Analysis Logs

General

Target

23e89a973e4a521395cec65e8a9ab1ec.exe
Size

27KB
MD5

23e89a973e4a521395cec65e8a9ab1ec
SHA1

a6e8be76d8ae1c7ab2822e1c3d3d7214bb46da8a
SHA256

8e1ba692294954ec47d7152683b618be994a6b4ffc583aa341c42cb5ae3d5cf3
SHA512

21c0510c3e36848971bf56eb00d327d63e9eb2d5149f292bc4c31d0077d40c83bed574ae06f0a9cb7310f6628f729af3a8335dc4cc29ed22c5fc8ad2d13072dd
SSDEEP

768:PQfTtUvAShKGCIUpp+mNDCjpXpox0rOaeoLZfS:PQhUoxGOpp+mNDCjdpoxjaDS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	1216	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3052	1216	23e89a973e4a521395cec65e8a9ab1ec.exe	28
PID 1216 wrote to memory of 3052	1216	23e89a973e4a521395cec65e8a9ab1ec.exe	28
PID 1216 wrote to memory of 3052	1216	23e89a973e4a521395cec65e8a9ab1ec.exe	28
PID 1216 wrote to memory of 3052	1216	23e89a973e4a521395cec65e8a9ab1ec.exe	28

C:\Users\Admin\AppData\Local\Temp\23e89a973e4a521395cec65e8a9ab1ec.exe
"C:\Users\Admin\AppData\Local\Temp\23e89a973e4a521395cec65e8a9ab1ec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 44
  2⤵
  - Program crash
  PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download