22959a2a753fabc7bad2d3bb3a1180536b7bd36882f6ef9d22fdc85d6b60866d | Triage

Analysis

max time kernel
81s
max time network
35s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:18

Sharing

Report Analysis Logs

General

Target

398cf33839fb41c3d563ee0ec84b639b.exe
Size

29KB
MD5

398cf33839fb41c3d563ee0ec84b639b
SHA1

5b63194470c44103dbbb74b0808ee4c1233c557f
SHA256

22959a2a753fabc7bad2d3bb3a1180536b7bd36882f6ef9d22fdc85d6b60866d
SHA512

b7bfc9d861708cbc7bd2dda9da5ca654bdd5fe9d1681ba4699bf2995177e4a19b173562d534b2bab63462dfc0c795b67acdd830aa172b4524b621f8a981d88ac
SSDEEP

768:4KaCfOsSrcqqIvbhxeYIZKweiwR8UkYK2:4KaWpL1I9zweik8UkQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2568	2628	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2568	2628	398cf33839fb41c3d563ee0ec84b639b.exe	29
PID 2628 wrote to memory of 2568	2628	398cf33839fb41c3d563ee0ec84b639b.exe	29
PID 2628 wrote to memory of 2568	2628	398cf33839fb41c3d563ee0ec84b639b.exe	29
PID 2628 wrote to memory of 2568	2628	398cf33839fb41c3d563ee0ec84b639b.exe	29

C:\Users\Admin\AppData\Local\Temp\398cf33839fb41c3d563ee0ec84b639b.exe
"C:\Users\Admin\AppData\Local\Temp\398cf33839fb41c3d563ee0ec84b639b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 36
  2⤵
  - Program crash
  PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download