c8a0b7a80ea85a6c138e2fb05a96a96f3aec6380ddf1da79c043c63828e0cf7b | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:17

Sharing

Report Analysis Logs

General

Target

243ca8cff4302341e40363eb45f4a265.exe
Size

31KB
MD5

243ca8cff4302341e40363eb45f4a265
SHA1

94dd3487103eea08c9ae215ae7bdf7492b04b0ab
SHA256

c8a0b7a80ea85a6c138e2fb05a96a96f3aec6380ddf1da79c043c63828e0cf7b
SHA512

7a30beecf53fcafa2e1904f4bf55256596da825330f95dbb05c8f67121f9cb6711593c5b905e67c7c5046fbca56b25e2d686b8164e25fcb609259a75a48833cc
SSDEEP

384:4fuB87EwseOvnnmDok+us4ZH/swx8ks1ck52hRzNEOxu:4w87ENeOJknt1VmO7A

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2796	1100	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2796	1100	243ca8cff4302341e40363eb45f4a265.exe	14
PID 1100 wrote to memory of 2796	1100	243ca8cff4302341e40363eb45f4a265.exe	14
PID 1100 wrote to memory of 2796	1100	243ca8cff4302341e40363eb45f4a265.exe	14
PID 1100 wrote to memory of 2796	1100	243ca8cff4302341e40363eb45f4a265.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 148
1⤵
- Program crash
PID:2796

C:\Users\Admin\AppData\Local\Temp\243ca8cff4302341e40363eb45f4a265.exe
"C:\Users\Admin\AppData\Local\Temp\243ca8cff4302341e40363eb45f4a265.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-0-0x0000000000400000-0x000000000040588C-memory.dmp

Filesize
22KB

Download