b5dc333ea161b6f0bb450381a915552f631143ec0f9d8731234837d7e77449fc | Triage

Analysis

max time kernel
122s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:14

Sharing

Report Analysis Logs

General

Target

241fb1c991e8bebd35961c053c6f15aa.exe
Size

18KB
MD5

241fb1c991e8bebd35961c053c6f15aa
SHA1

545f7d04ac065af9a37c5b8c5011c539b91500e7
SHA256

b5dc333ea161b6f0bb450381a915552f631143ec0f9d8731234837d7e77449fc
SHA512

a1931237e0ebb1a57bd701968c04e313b466595b7336c56a71e59f839e5a06a73c8f9ed2f47d5c08405718d92e8ab62708bde2a5f13cbe0ba20ddaadf50153af
SSDEEP

384:vSlgQcaIoqpDgg7SUse81A6PyU6eDbkUH+T9NY:Xtg7Ua1A66ADbteI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	1892	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1716	1892	241fb1c991e8bebd35961c053c6f15aa.exe	29
PID 1892 wrote to memory of 1716	1892	241fb1c991e8bebd35961c053c6f15aa.exe	29
PID 1892 wrote to memory of 1716	1892	241fb1c991e8bebd35961c053c6f15aa.exe	29
PID 1892 wrote to memory of 1716	1892	241fb1c991e8bebd35961c053c6f15aa.exe	29

C:\Users\Admin\AppData\Local\Temp\241fb1c991e8bebd35961c053c6f15aa.exe
"C:\Users\Admin\AppData\Local\Temp\241fb1c991e8bebd35961c053c6f15aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 88
  2⤵
  - Program crash
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download