da94e9d1fd07accbfd6f06dd0d44d6980f5a084783cf2b2fbf9bfb7f5f920b06 | Triage

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:27

Sharing

Report Analysis Logs

General

Target

2baf3aba66746c388a77c7ea3895ecb6.exe
Size

107KB
MD5

2baf3aba66746c388a77c7ea3895ecb6
SHA1

9976d075a2f213e15ebf83c67e54d6a437c3e84e
SHA256

da94e9d1fd07accbfd6f06dd0d44d6980f5a084783cf2b2fbf9bfb7f5f920b06
SHA512

9d78d7c8603ac1dfe352064cdbf19bec4fac456c8d911953ef795897dce98b5f1f0549ffb403d606affc18a5079b63b1c615245cb661d25408f3b6f260c8abb1
SSDEEP

3072:wRcPpKqTjAGtGTkDPQfReom2Lj9Ar0SZRg:woYujAGIT+YFPmZR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2772	2372	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2772	2372	2baf3aba66746c388a77c7ea3895ecb6.exe	16
PID 2372 wrote to memory of 2772	2372	2baf3aba66746c388a77c7ea3895ecb6.exe	16
PID 2372 wrote to memory of 2772	2372	2baf3aba66746c388a77c7ea3895ecb6.exe	16
PID 2372 wrote to memory of 2772	2372	2baf3aba66746c388a77c7ea3895ecb6.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 116
1⤵
- Program crash
PID:2772

C:\Users\Admin\AppData\Local\Temp\2baf3aba66746c388a77c7ea3895ecb6.exe
"C:\Users\Admin\AppData\Local\Temp\2baf3aba66746c388a77c7ea3895ecb6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2372-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download