05fb91f442ae1f7b1ee14d935fec13e9a68d1d8eae593a7af82a7a3239e2137b | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 10:15

Sharing

Report Analysis Logs

General

Target

3c9789e1ee979134439cd5049104cb88.exe
Size

49KB
MD5

3c9789e1ee979134439cd5049104cb88
SHA1

44957eb4b1dd6219db7abf2c579817d237e9e8f7
SHA256

05fb91f442ae1f7b1ee14d935fec13e9a68d1d8eae593a7af82a7a3239e2137b
SHA512

5131a3ba6aadc6547ce4b31c823ed9bcb13e23cc709024d4e6fd28c16756aa4fc62f5bdc95f15163822ee969be092be7b6d3e1f2e509356993760db48fd7ab47
SSDEEP

1536:8t9Wlg7w0P4EgmbJS6N+PmSSLounch18xt3djjr3s:i9aZ0PXNh9LVWKxXP3s

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2316	2212	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2316	2212	3c9789e1ee979134439cd5049104cb88.exe	14
PID 2212 wrote to memory of 2316	2212	3c9789e1ee979134439cd5049104cb88.exe	14
PID 2212 wrote to memory of 2316	2212	3c9789e1ee979134439cd5049104cb88.exe	14
PID 2212 wrote to memory of 2316	2212	3c9789e1ee979134439cd5049104cb88.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 96
1⤵
- Program crash
PID:2316

C:\Users\Admin\AppData\Local\Temp\3c9789e1ee979134439cd5049104cb88.exe
"C:\Users\Admin\AppData\Local\Temp\3c9789e1ee979134439cd5049104cb88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2212-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download