9d5095ee6bd73336a48a69ad0c924f9413e09fd802d9b119f6275980ceb4fcdf | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:11

Sharing

Report Analysis Logs

General

Target

395392a52c90042add9f19f508a02a1a.exe
Size

116KB
MD5

395392a52c90042add9f19f508a02a1a
SHA1

c5af1be87682b6c3e2bf484fdb20eb4aa8954068
SHA256

9d5095ee6bd73336a48a69ad0c924f9413e09fd802d9b119f6275980ceb4fcdf
SHA512

13afa75974b67f8d7f603174f80738a40424e5634d920c619a8ea85707ca7f769d8915cffb5b5ff803c70ecb899b439b3ec89545649868a2bc299effbf6c9095
SSDEEP

3072:VEOAsRgLX57NmWx6TKUsAhGrg5sUDHqdUNI35hgp:yNX54x+Urhqg5sUKV7gp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2432	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3028	2432	395392a52c90042add9f19f508a02a1a.exe	16
PID 2432 wrote to memory of 3028	2432	395392a52c90042add9f19f508a02a1a.exe	16
PID 2432 wrote to memory of 3028	2432	395392a52c90042add9f19f508a02a1a.exe	16
PID 2432 wrote to memory of 3028	2432	395392a52c90042add9f19f508a02a1a.exe	16

C:\Users\Admin\AppData\Local\Temp\395392a52c90042add9f19f508a02a1a.exe
"C:\Users\Admin\AppData\Local\Temp\395392a52c90042add9f19f508a02a1a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 36
  2⤵
  - Program crash
  PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download