9a269a86389156bf0d211d99d02254c3bdc1eb165df8d17c592a66d44cc87802 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:46

Sharing

Report Analysis Logs

General

Target

36a099e37e2eb27b10b92605af8ade98.exe
Size

259KB
MD5

36a099e37e2eb27b10b92605af8ade98
SHA1

6548a5d513ccb19cab79dedfe9173ccc499c7e8c
SHA256

9a269a86389156bf0d211d99d02254c3bdc1eb165df8d17c592a66d44cc87802
SHA512

41916a7edcfcf661fc4044efb687e918174ff0469cc592a78792b22718e2887d3f94926827de7086570989f23ffaac3c9a16d2068aeb5188ba3e2faee0197283
SSDEEP

6144:8Yu7nerS/7g1rwRCuq9ndgt3BcoxxjiXu0ahWSttQZ7:oncSEb9+tx/3Vj3t69

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2292	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3040	2292	36a099e37e2eb27b10b92605af8ade98.exe	28
PID 2292 wrote to memory of 3040	2292	36a099e37e2eb27b10b92605af8ade98.exe	28
PID 2292 wrote to memory of 3040	2292	36a099e37e2eb27b10b92605af8ade98.exe	28
PID 2292 wrote to memory of 3040	2292	36a099e37e2eb27b10b92605af8ade98.exe	28

C:\Users\Admin\AppData\Local\Temp\36a099e37e2eb27b10b92605af8ade98.exe
"C:\Users\Admin\AppData\Local\Temp\36a099e37e2eb27b10b92605af8ade98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 140
  2⤵
  - Program crash
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads