147dad1ec8b536c84eec6fcbd8090ced1c98b93055108b2fecbd44bbbdc09681 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:22

Sharing

Report Analysis Logs

General

Target

2b9415cfa1a42d48e669d141de5fa373.exe
Size

262KB
MD5

2b9415cfa1a42d48e669d141de5fa373
SHA1

dc108be76b18c6e3cb7d4f081ab858a5fbab8f55
SHA256

147dad1ec8b536c84eec6fcbd8090ced1c98b93055108b2fecbd44bbbdc09681
SHA512

d0ee6bfc8007d67559c72fe516a51370254efd7e4ea5282381df304fd9189ea6dacbf3b6f517cedb04eeb5198c858cf003b6693c32b60c0a1366cde21fb76423
SSDEEP

6144:QnI4olIL3ZqqCBSJQfJ+YaDP54oSTasyNm:Mo2FskYajDFW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	2536	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2904	2536	2b9415cfa1a42d48e669d141de5fa373.exe	16
PID 2536 wrote to memory of 2904	2536	2b9415cfa1a42d48e669d141de5fa373.exe	16
PID 2536 wrote to memory of 2904	2536	2b9415cfa1a42d48e669d141de5fa373.exe	16
PID 2536 wrote to memory of 2904	2536	2b9415cfa1a42d48e669d141de5fa373.exe	16

C:\Users\Admin\AppData\Local\Temp\2b9415cfa1a42d48e669d141de5fa373.exe
"C:\Users\Admin\AppData\Local\Temp\2b9415cfa1a42d48e669d141de5fa373.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 36
  2⤵
  - Program crash
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download