d39e39d1cab8ed9295f52256df1229997d1f27c7c71939eb29b79cb329a73dc6 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 09:45

Sharing

Report Analysis Logs

General

Target

3168f4d5cdc232eb6d65f5f2af9c249a.exe
Size

3.6MB
MD5

3168f4d5cdc232eb6d65f5f2af9c249a
SHA1

caa8bc43ae9263acb1ab8bbbe2aca1b79b03cfb8
SHA256

d39e39d1cab8ed9295f52256df1229997d1f27c7c71939eb29b79cb329a73dc6
SHA512

851f969a13eddbf8a58ab41c4f970f0318499e86ff07b9e8b78bc281f00b4ebf76edb55f7d0e1962b230966c2c29f75a97bc7cc3031330b5185e5362732a02c6
SSDEEP

49152:zAdGB73ejP3+EMfRdASVaAvrN5Xh602+:zAgR3epMjASHPh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2736	1652	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2736	1652	3168f4d5cdc232eb6d65f5f2af9c249a.exe	17
PID 1652 wrote to memory of 2736	1652	3168f4d5cdc232eb6d65f5f2af9c249a.exe	17
PID 1652 wrote to memory of 2736	1652	3168f4d5cdc232eb6d65f5f2af9c249a.exe	17
PID 1652 wrote to memory of 2736	1652	3168f4d5cdc232eb6d65f5f2af9c249a.exe	17

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 104
1⤵
- Program crash
PID:2736

C:\Users\Admin\AppData\Local\Temp\3168f4d5cdc232eb6d65f5f2af9c249a.exe
"C:\Users\Admin\AppData\Local\Temp\3168f4d5cdc232eb6d65f5f2af9c249a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads