f4e11452998102e7f353d5d3abf605ea71b6057970030fcf419ce72f5476b01a | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 11:04

Sharing

Report Analysis Logs

General

Target

executable.2096.exe
Size

295KB
MD5

e56837c21cca18641f06d375a49aabdc
SHA1

1fb64eaedc67f4d047b26d5f273da7dfb064aaf2
SHA256

f4e11452998102e7f353d5d3abf605ea71b6057970030fcf419ce72f5476b01a
SHA512

2162dc598f725e35a8c688d499944a9e8ce4c90a679a93d5b19c0b5b986dd9329c39a9a1886b76fe70602f215350b5d6e788e2ac36f78a86e4b969d2850f47ef
SSDEEP

3072:RFtn1cZcSrNdNQG2y7I1F5Xd0vPgxsk0h:ft1cZcShQHR8Pgxsk0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	2152	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2944	2152	executable.2096.exe	29
PID 2152 wrote to memory of 2944	2152	executable.2096.exe	29
PID 2152 wrote to memory of 2944	2152	executable.2096.exe	29
PID 2152 wrote to memory of 2944	2152	executable.2096.exe	29

C:\Users\Admin\AppData\Local\Temp\executable.2096.exe
"C:\Users\Admin\AppData\Local\Temp\executable.2096.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 104
  2⤵
  - Program crash
  PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads