6e1b923982ca6232931c7c999a3c8d7ce8123b1c4f1ca38d6e7c3f2886047a99 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:40

Sharing

Report Analysis Logs

General

Target

385e6e623d74631f3b13c2e845e13c8e.exe
Size

49KB
MD5

385e6e623d74631f3b13c2e845e13c8e
SHA1

8b3de134b55438ca39ccd625a795ca90ae56c344
SHA256

6e1b923982ca6232931c7c999a3c8d7ce8123b1c4f1ca38d6e7c3f2886047a99
SHA512

f89e2b086f34e89fb542816c7761da6e675c4c5af4f64d6e3bb6e717dadbb977868f9c6e22eb11c0325cdd704473156b7604c63897fbc4695633a2b5f1a15cbc
SSDEEP

1536:zIP6WfuGTTcLzHK1QUV8pkhUmGrZkoc+6YJ9quf:zI2vK1QUzinZko1JUG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2440	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3060	2440	385e6e623d74631f3b13c2e845e13c8e.exe	28
PID 2440 wrote to memory of 3060	2440	385e6e623d74631f3b13c2e845e13c8e.exe	28
PID 2440 wrote to memory of 3060	2440	385e6e623d74631f3b13c2e845e13c8e.exe	28
PID 2440 wrote to memory of 3060	2440	385e6e623d74631f3b13c2e845e13c8e.exe	28

C:\Users\Admin\AppData\Local\Temp\385e6e623d74631f3b13c2e845e13c8e.exe
"C:\Users\Admin\AppData\Local\Temp\385e6e623d74631f3b13c2e845e13c8e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 36
  2⤵
  - Program crash
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download