22d9041bac201d6103e17c23b3071d1ae3e233bf4f2b52a0b2d497f63fd17433 | Triage

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 13:43

Sharing

Report Analysis Logs

General

Target

3eaff0ae5144fba3de315dba527810b6.exe
Size

53KB
MD5

3eaff0ae5144fba3de315dba527810b6
SHA1

2ad8f21cb8b5b224ae9c6c67c6540982ab2a902b
SHA256

22d9041bac201d6103e17c23b3071d1ae3e233bf4f2b52a0b2d497f63fd17433
SHA512

0c3990dd5271c8435f6c3b3e15aeee2783e327e946b5cf60dfe5713152cd7fd255e46df16aa354be06667976906f3f31d7394b56926067cf757537ddea962a9c
SSDEEP

1536:A+xu+GKJAXou2YE1ykk9xsIkTGwVgRhhWYG:9LG+aoVYaZQXP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1088	2508	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1088	2508	3eaff0ae5144fba3de315dba527810b6.exe	16
PID 2508 wrote to memory of 1088	2508	3eaff0ae5144fba3de315dba527810b6.exe	16
PID 2508 wrote to memory of 1088	2508	3eaff0ae5144fba3de315dba527810b6.exe	16
PID 2508 wrote to memory of 1088	2508	3eaff0ae5144fba3de315dba527810b6.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 64
1⤵
- Program crash
PID:1088

C:\Users\Admin\AppData\Local\Temp\3eaff0ae5144fba3de315dba527810b6.exe
"C:\Users\Admin\AppData\Local\Temp\3eaff0ae5144fba3de315dba527810b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads