f7cae46c8b688bb27e5459c9061b1ece83468c44f21f8bd497e49e7d7f122ae6 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:23

Sharing

Report Analysis Logs

General

Target

2d3bca2121f3615f11d20721caddd922.exe
Size

11KB
MD5

2d3bca2121f3615f11d20721caddd922
SHA1

fd1ee40a040698c07571caab068355ab558ccc88
SHA256

f7cae46c8b688bb27e5459c9061b1ece83468c44f21f8bd497e49e7d7f122ae6
SHA512

4e0a8c080d5b49420a4e78a93fe33b9419b71542447c363adebbcc6849ea1cd6220d3ef595551e74f21973ee457d26e24e36ce31ba21f38fd8923a3d52c72533
SSDEEP

192:XDjtfTCU7n8oLObSEX/HOa3aRrS9L1TpgdOoep00O0y:/go8o9gpor+Jp/oe9O0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	2772	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1124	2772	2d3bca2121f3615f11d20721caddd922.exe	28
PID 2772 wrote to memory of 1124	2772	2d3bca2121f3615f11d20721caddd922.exe	28
PID 2772 wrote to memory of 1124	2772	2d3bca2121f3615f11d20721caddd922.exe	28
PID 2772 wrote to memory of 1124	2772	2d3bca2121f3615f11d20721caddd922.exe	28

C:\Users\Admin\AppData\Local\Temp\2d3bca2121f3615f11d20721caddd922.exe
"C:\Users\Admin\AppData\Local\Temp\2d3bca2121f3615f11d20721caddd922.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 44
  2⤵
  - Program crash
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads