853f3e4a8aece8d368c2d9deff0e49d5c8e71f11d80d939b9c14f0261a9c2be9 | Triage

Analysis

max time kernel
179s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ac5ff61c530050d8739c036d3a3dd7d.exe
Size

79KB
MD5

3ac5ff61c530050d8739c036d3a3dd7d
SHA1

63fec5e166f20b5046f854baaf7d348a3d4d8877
SHA256

853f3e4a8aece8d368c2d9deff0e49d5c8e71f11d80d939b9c14f0261a9c2be9
SHA512

555162c49e10432f19641580a97dfd8eb3eba88faea77a444787df5663c4a6dafd1912edf9561abd42db8d36b2796a49cf05db0660528cc37ee81c6310305a1a
SSDEEP

1536:NIP5MzLpvOwjavf5UpLQCRvMGsMDcgfGMXLBRfr:eP5Mzlja3lCRRfGIRf

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3932	4984	WerFault.exe	31
1640	4984	WerFault.exe	31

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3932	4984	3ac5ff61c530050d8739c036d3a3dd7d.exe	93
PID 4984 wrote to memory of 3932	4984	3ac5ff61c530050d8739c036d3a3dd7d.exe	93
PID 4984 wrote to memory of 3932	4984	3ac5ff61c530050d8739c036d3a3dd7d.exe	93

C:\Users\Admin\AppData\Local\Temp\3ac5ff61c530050d8739c036d3a3dd7d.exe
"C:\Users\Admin\AppData\Local\Temp\3ac5ff61c530050d8739c036d3a3dd7d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 276
  2⤵
  - Program crash
  PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 276
  2⤵
  - Program crash
  PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4984 -ip 4984
1⤵
PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4984-0-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download
memory/4984-12-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download