b22f604691deb0e864e5f78903f85d36ca80712f2a1dcfd4e06704f10e1741be | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:25

Sharing

Report Analysis Logs

General

Target

2d4ccaced33e2d951bd293c00494b55e.exe
Size

30KB
MD5

2d4ccaced33e2d951bd293c00494b55e
SHA1

376b66e5fbcab9e77827673ed3fb9090b56b5d65
SHA256

b22f604691deb0e864e5f78903f85d36ca80712f2a1dcfd4e06704f10e1741be
SHA512

d8ee70f903cb5ee112d02ef6f91191bcaa4681aa909e58feb6adbbe650410ed05c54e790b9c11498982fdd7f58cd5dbbe5f038ce71bd6c605cffd32f7f911f11
SSDEEP

768:UWD363pNhTwtdPdLZxHRvZQF4NjQ0T1zvklqq9vc:UWspjc3P5xrKa9/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2156	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1988	2156	2d4ccaced33e2d951bd293c00494b55e.exe	15
PID 2156 wrote to memory of 1988	2156	2d4ccaced33e2d951bd293c00494b55e.exe	15
PID 2156 wrote to memory of 1988	2156	2d4ccaced33e2d951bd293c00494b55e.exe	15
PID 2156 wrote to memory of 1988	2156	2d4ccaced33e2d951bd293c00494b55e.exe	15

C:\Users\Admin\AppData\Local\Temp\2d4ccaced33e2d951bd293c00494b55e.exe
"C:\Users\Admin\AppData\Local\Temp\2d4ccaced33e2d951bd293c00494b55e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 36
  2⤵
  - Program crash
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download