56d078bfc8c52852f59269ce2b2f035bcba8b6f18da324fac7d81caff04d3310 | Triage

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:42

Sharing

Report Analysis Logs

General

Target

2a6f93544c611bd5ecd7dd53586640de.exe
Size

57KB
MD5

2a6f93544c611bd5ecd7dd53586640de
SHA1

dc2ee83dd39c658615cb55df12f0453bbc9d275d
SHA256

56d078bfc8c52852f59269ce2b2f035bcba8b6f18da324fac7d81caff04d3310
SHA512

3643462b03d22ccdf2a09535da93f283c5483b9de60f88a8fa4017f563e14c63ad24292f3c9be053bc7b4f7c1cf3ab988e7315ce8b8cbefb91ea9e3b3a682522
SSDEEP

1536:AtVyxh0kBtwo4CtGCvTKy0xQ4lsYcUimYkc:AtVy7bBtwGtPbsxQEsYcxmN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
824	2128	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 824	2128	2a6f93544c611bd5ecd7dd53586640de.exe	28
PID 2128 wrote to memory of 824	2128	2a6f93544c611bd5ecd7dd53586640de.exe	28
PID 2128 wrote to memory of 824	2128	2a6f93544c611bd5ecd7dd53586640de.exe	28
PID 2128 wrote to memory of 824	2128	2a6f93544c611bd5ecd7dd53586640de.exe	28

C:\Users\Admin\AppData\Local\Temp\2a6f93544c611bd5ecd7dd53586640de.exe
"C:\Users\Admin\AppData\Local\Temp\2a6f93544c611bd5ecd7dd53586640de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 108
  2⤵
  - Program crash
  PID:824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download