44fe69bcf4709ffa0a3d360b1183cd1e76767fca98fb426ab2a47cce9f346b57 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 22:39

Sharing

Report Analysis Logs

General

Target

4217a8b8c14491fadc2cb4d71776f1a1.exe
Size

39KB
MD5

4217a8b8c14491fadc2cb4d71776f1a1
SHA1

dd77bbb31dc620e84d969e015bc3a39d8e85beaf
SHA256

44fe69bcf4709ffa0a3d360b1183cd1e76767fca98fb426ab2a47cce9f346b57
SHA512

50dfbc9505666c21d828fd6ddba10662d173e21ed0ceae618b3014da479421c0acf96cbf4eeca5f2858badf1dc923f5dda40e3583b4ed42d08bb4eca24e6de95
SSDEEP

768:jJ7Ln2I2hqCniGU1JTcyZI9BZIVKRvw21nnnnRYZxX:B6fL4UBZiKRY+YfX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	2732	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 864	2732	4217a8b8c14491fadc2cb4d71776f1a1.exe	15
PID 2732 wrote to memory of 864	2732	4217a8b8c14491fadc2cb4d71776f1a1.exe	15
PID 2732 wrote to memory of 864	2732	4217a8b8c14491fadc2cb4d71776f1a1.exe	15
PID 2732 wrote to memory of 864	2732	4217a8b8c14491fadc2cb4d71776f1a1.exe	15

C:\Users\Admin\AppData\Local\Temp\4217a8b8c14491fadc2cb4d71776f1a1.exe
"C:\Users\Admin\AppData\Local\Temp\4217a8b8c14491fadc2cb4d71776f1a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 152
  2⤵
  - Program crash
  PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2732-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download