18ca39eeb02d4aca4bb092e46f37956a4cf3f5e56e7dee01c93ddddd9fcca11d | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:30

Sharing

Report Analysis Logs

General

Target

2bc09f8cb2d4b7f04107926300ae1180.exe
Size

46KB
MD5

2bc09f8cb2d4b7f04107926300ae1180
SHA1

efad479c9d51dd6c61ac4bac1417bae397f46136
SHA256

18ca39eeb02d4aca4bb092e46f37956a4cf3f5e56e7dee01c93ddddd9fcca11d
SHA512

a0cf083921de5bc5dd80ea126c6934b42fd15dcbf6ec70a72cc862c90e2037651e4089718056da3b16e31eb603a35ff21fd4db153754c22f785ae2bacf174b5e
SSDEEP

768:LhN9wVRbuIWjrz91TxY5Fm2M7wsdPhieQDP7O9V:10IIO91TxymtheDPm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3056	3000	2bc09f8cb2d4b7f04107926300ae1180.exe	28
PID 3000 wrote to memory of 3056	3000	2bc09f8cb2d4b7f04107926300ae1180.exe	28
PID 3000 wrote to memory of 3056	3000	2bc09f8cb2d4b7f04107926300ae1180.exe	28
PID 3000 wrote to memory of 3056	3000	2bc09f8cb2d4b7f04107926300ae1180.exe	28

C:\Users\Admin\AppData\Local\Temp\2bc09f8cb2d4b7f04107926300ae1180.exe
"C:\Users\Admin\AppData\Local\Temp\2bc09f8cb2d4b7f04107926300ae1180.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 88
  2⤵
  - Program crash
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download