7ea028bdb909f998cdd34632710d4334558c47ab924e3861fab584ac5385334a | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:31

Sharing

Report Analysis Logs

General

Target

39eaf6c9b3c76f1831cda945b309eb35.exe
Size

14KB
MD5

39eaf6c9b3c76f1831cda945b309eb35
SHA1

1595876cbbc29aa1e311c6dc7f6b2eca69cc8162
SHA256

7ea028bdb909f998cdd34632710d4334558c47ab924e3861fab584ac5385334a
SHA512

ca063809c099533f85402c79c57e9ad259c406cef1af653e25d6a6509f597df6ec20a485cf2d158d44f512cda0e6396c2f250d3b7fc84b212cce53982619f56a
SSDEEP

384:b35x7cR+byjOyyVZ6RCpsJYuEnuDqFmMy:j5x7C+byjOy4URCpTm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	2120	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2280	2120	39eaf6c9b3c76f1831cda945b309eb35.exe	28
PID 2120 wrote to memory of 2280	2120	39eaf6c9b3c76f1831cda945b309eb35.exe	28
PID 2120 wrote to memory of 2280	2120	39eaf6c9b3c76f1831cda945b309eb35.exe	28
PID 2120 wrote to memory of 2280	2120	39eaf6c9b3c76f1831cda945b309eb35.exe	28

C:\Users\Admin\AppData\Local\Temp\39eaf6c9b3c76f1831cda945b309eb35.exe
"C:\Users\Admin\AppData\Local\Temp\39eaf6c9b3c76f1831cda945b309eb35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 36
  2⤵
  - Program crash
  PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2120-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download