3394a09b1504e385d037b26dacb594ed51f84cc4d3a9262ea686f40cb54199fa | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

253126339fc1a4f60d91e19c78918433.exe
Size

113KB
MD5

253126339fc1a4f60d91e19c78918433
SHA1

e821f77c1712f9cf1a4a1f75ef36edbd70bc7b72
SHA256

3394a09b1504e385d037b26dacb594ed51f84cc4d3a9262ea686f40cb54199fa
SHA512

2367e9d6cbcb2afc4ffae1bcafd46227c790f98280351b85b10303bc35b8fb6d576300b6778313dc43cdc1efdf717916fd095c20b8b049db906fcd1447c92b65
SSDEEP

3072:8AXDRoWgtF4IXWb9SZHueddQ3HYi+BeEkd2L:NFotyb9SUe03C4y

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2416	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2920	2416	253126339fc1a4f60d91e19c78918433.exe	28
PID 2416 wrote to memory of 2920	2416	253126339fc1a4f60d91e19c78918433.exe	28
PID 2416 wrote to memory of 2920	2416	253126339fc1a4f60d91e19c78918433.exe	28
PID 2416 wrote to memory of 2920	2416	253126339fc1a4f60d91e19c78918433.exe	28

C:\Users\Admin\AppData\Local\Temp\253126339fc1a4f60d91e19c78918433.exe
"C:\Users\Admin\AppData\Local\Temp\253126339fc1a4f60d91e19c78918433.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 36
  2⤵
  - Program crash
  PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2416-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download