34f8ebf86ba24691e46e42e38b64fa8bbdeaa2577c837f93b9da3f37c0c2c837 | Triage

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:33

Sharing

Report Analysis Logs

General

Target

2850062325efb4a345306f863d41ebec.exe
Size

5KB
MD5

2850062325efb4a345306f863d41ebec
SHA1

7e5f37e935070de7cf26af001a84d8bb712c1cf7
SHA256

34f8ebf86ba24691e46e42e38b64fa8bbdeaa2577c837f93b9da3f37c0c2c837
SHA512

f385ede4db03fe83f7db51d6f083e39e40c5d6b90b76200db1b73ab4912d68d934613b8edfbcad06d2ae391e3357796cafb9476f7493dfb8c8211555e40f735a
SSDEEP

96:hX3AI91U9k1lgZ718IwE0gcuuWu6prisVj2JFQEQ:hAA1lXg5uhIH2JFQX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2128	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1728	2128	2850062325efb4a345306f863d41ebec.exe	28
PID 2128 wrote to memory of 1728	2128	2850062325efb4a345306f863d41ebec.exe	28
PID 2128 wrote to memory of 1728	2128	2850062325efb4a345306f863d41ebec.exe	28
PID 2128 wrote to memory of 1728	2128	2850062325efb4a345306f863d41ebec.exe	28

C:\Users\Admin\AppData\Local\Temp\2850062325efb4a345306f863d41ebec.exe
"C:\Users\Admin\AppData\Local\Temp\2850062325efb4a345306f863d41ebec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 36
  2⤵
  - Program crash
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x0000000000400000-0x0000000000403400-memory.dmp

Filesize
13KB

Download
memory/2128-1-0x0000000000400000-0x0000000000403400-memory.dmp

Filesize
13KB

Download