e4413796359aa2088f0c852d61907d88faf1592707475a1f1fd0dacec35612bf | Triage

Analysis

max time kernel
177s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25b8dbb32382b6cdf02f527a3de4a7c2.exe
Size

77KB
MD5

25b8dbb32382b6cdf02f527a3de4a7c2
SHA1

da3fc47c46dde0486c5b7da46c095d7c12dcd0ff
SHA256

e4413796359aa2088f0c852d61907d88faf1592707475a1f1fd0dacec35612bf
SHA512

c2a3af67eed9992dcafe536f6627dd5eb4621c69f842216a29bbc8c12cbde295aa3c85aa83a15a368968f29b98b836478d34553c0ab6cc7b7e9ac50d30eb5669
SSDEEP

1536:hccuKhF+kKRF4lXKGiw7eBsCXK15Zu6Lpcwn:hccuK8FbGtiBsr5Zuycwn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2808	2724	WerFault.exe	5

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2808	2724	25b8dbb32382b6cdf02f527a3de4a7c2.exe	28
PID 2724 wrote to memory of 2808	2724	25b8dbb32382b6cdf02f527a3de4a7c2.exe	28
PID 2724 wrote to memory of 2808	2724	25b8dbb32382b6cdf02f527a3de4a7c2.exe	28
PID 2724 wrote to memory of 2808	2724	25b8dbb32382b6cdf02f527a3de4a7c2.exe	28

C:\Users\Admin\AppData\Local\Temp\25b8dbb32382b6cdf02f527a3de4a7c2.exe
"C:\Users\Admin\AppData\Local\Temp\25b8dbb32382b6cdf02f527a3de4a7c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 92
  2⤵
  - Program crash
  PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2724-0-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/2724-1-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download