d050f370028c910e2e1321142ca5141a6452c10fad86b4e9717ea9d2c259cc4b | Triage

Analysis

max time kernel
24s
max time network
26s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:14

Sharing

Report Analysis Logs

General

Target

24244ddf4fcc4c83996bc8dd83e3e822.exe
Size

84KB
MD5

24244ddf4fcc4c83996bc8dd83e3e822
SHA1

2d02baac3689af41a425c0e0a41caa6a0244de4e
SHA256

d050f370028c910e2e1321142ca5141a6452c10fad86b4e9717ea9d2c259cc4b
SHA512

7a39bf7bfca98cb6b3a25ff9449091884c56c96a1e2c03bf073672c41f7b67639aba43a22ab8cffbe54f231928e9620687a20db25597a541c21be18d7b3d118d
SSDEEP

1536:1lgQwkCR4IDNuBhNOV6baOUn0f7pzmVIU:nIDBWNL1Sudz/U

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2768	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2736	2768	24244ddf4fcc4c83996bc8dd83e3e822.exe	29
PID 2768 wrote to memory of 2736	2768	24244ddf4fcc4c83996bc8dd83e3e822.exe	29
PID 2768 wrote to memory of 2736	2768	24244ddf4fcc4c83996bc8dd83e3e822.exe	29
PID 2768 wrote to memory of 2736	2768	24244ddf4fcc4c83996bc8dd83e3e822.exe	29

C:\Users\Admin\AppData\Local\Temp\24244ddf4fcc4c83996bc8dd83e3e822.exe
"C:\Users\Admin\AppData\Local\Temp\24244ddf4fcc4c83996bc8dd83e3e822.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 92
  2⤵
  - Program crash
  PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads