2e325217c15603b076e3a11e707a775130c7bbb922ca114d3fbbe5f785ee39f7 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 21:12

Sharing

Report Analysis Logs

General

Target

3de5791b8fdecf24fcae404e131e76f3.exe
Size

77KB
MD5

3de5791b8fdecf24fcae404e131e76f3
SHA1

d3180761e5df084b823f0092d85dd1df48ff6d31
SHA256

2e325217c15603b076e3a11e707a775130c7bbb922ca114d3fbbe5f785ee39f7
SHA512

0b70f7792f92087b7706609e20954735b481cd3e11945e77a38c582c260e1a89012497defc791965202485f0b83af81b99fdf55e247fcd56e2cf2aa363f4d431
SSDEEP

1536:mkQ9TfUeMCRLLu22Y+QwmQI48XjynBuhE7Ijf5H0OB:6LMgLCnvF8X6L0/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	2896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2312	2896	3de5791b8fdecf24fcae404e131e76f3.exe	28
PID 2896 wrote to memory of 2312	2896	3de5791b8fdecf24fcae404e131e76f3.exe	28
PID 2896 wrote to memory of 2312	2896	3de5791b8fdecf24fcae404e131e76f3.exe	28
PID 2896 wrote to memory of 2312	2896	3de5791b8fdecf24fcae404e131e76f3.exe	28

C:\Users\Admin\AppData\Local\Temp\3de5791b8fdecf24fcae404e131e76f3.exe
"C:\Users\Admin\AppData\Local\Temp\3de5791b8fdecf24fcae404e131e76f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 144
  2⤵
  - Program crash
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2896-0-0x0000000000400000-0x0000000000438400-memory.dmp

Filesize
225KB

Download
memory/2896-1-0x0000000000400000-0x0000000000438400-memory.dmp

Filesize
225KB

Download