c8a0b7a80ea85a6c138e2fb05a96a96f3aec6380ddf1da79c043c63828e0cf7b | Triage

Analysis

max time kernel
151s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

243ca8cff4302341e40363eb45f4a265.exe
Size

31KB
MD5

243ca8cff4302341e40363eb45f4a265
SHA1

94dd3487103eea08c9ae215ae7bdf7492b04b0ab
SHA256

c8a0b7a80ea85a6c138e2fb05a96a96f3aec6380ddf1da79c043c63828e0cf7b
SHA512

7a30beecf53fcafa2e1904f4bf55256596da825330f95dbb05c8f67121f9cb6711593c5b905e67c7c5046fbca56b25e2d686b8164e25fcb609259a75a48833cc
SSDEEP

384:4fuB87EwseOvnnmDok+us4ZH/swx8ks1ck52hRzNEOxu:4w87ENeOJknt1VmO7A

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3044	1812	WerFault.exe	88
2420	1812	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3044	1812	243ca8cff4302341e40363eb45f4a265.exe	93
PID 1812 wrote to memory of 3044	1812	243ca8cff4302341e40363eb45f4a265.exe	93
PID 1812 wrote to memory of 3044	1812	243ca8cff4302341e40363eb45f4a265.exe	93

C:\Users\Admin\AppData\Local\Temp\243ca8cff4302341e40363eb45f4a265.exe
"C:\Users\Admin\AppData\Local\Temp\243ca8cff4302341e40363eb45f4a265.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 408
  2⤵
  - Program crash
  PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 408
  2⤵
  - Program crash
  PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1812 -ip 1812
1⤵
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1812-0-0x0000000000400000-0x000000000040588C-memory.dmp

Filesize
22KB

Download
memory/1812-1-0x0000000000400000-0x000000000040588C-memory.dmp

Filesize
22KB

Download