7e01330efa0b1b7b9f24e24aa022dcfbaccd02623a80aad112d832d1da892f2c | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

386e3ca3c4da724123dd6b5e956dfa79.exe
Size

118KB
MD5

386e3ca3c4da724123dd6b5e956dfa79
SHA1

37b5f080319a7756af3278309c70b07e3dd29e38
SHA256

7e01330efa0b1b7b9f24e24aa022dcfbaccd02623a80aad112d832d1da892f2c
SHA512

19b9410d7ad542d2a2c7067de27f0da7022e0f80d7635bebb137ee59766bc92b8fbfa284ad32a949f76ec43b12be70f0a3a900eec198ce2729a49268ec972d1d
SSDEEP

3072:uW3lGFVOYZ17hTikSdqfYVGgNmBcEfTBZHbXCzCb:DiOYNTiT31NmSETzQs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2432	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2864	2432	386e3ca3c4da724123dd6b5e956dfa79.exe	28
PID 2432 wrote to memory of 2864	2432	386e3ca3c4da724123dd6b5e956dfa79.exe	28
PID 2432 wrote to memory of 2864	2432	386e3ca3c4da724123dd6b5e956dfa79.exe	28
PID 2432 wrote to memory of 2864	2432	386e3ca3c4da724123dd6b5e956dfa79.exe	28

C:\Users\Admin\AppData\Local\Temp\386e3ca3c4da724123dd6b5e956dfa79.exe
"C:\Users\Admin\AppData\Local\Temp\386e3ca3c4da724123dd6b5e956dfa79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 36
  2⤵
  - Program crash
  PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2432-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download