77c53aec346efbea31773751fd1056e5644f3a8300f8894805de13a354ce033e | Triage

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40075ac532b5213f6117d80829161c80.exe
Size

30KB
MD5

40075ac532b5213f6117d80829161c80
SHA1

acd8507c1a2ee6a5edcaa5dddcff568363d1187b
SHA256

77c53aec346efbea31773751fd1056e5644f3a8300f8894805de13a354ce033e
SHA512

53f6eed96f781164bab628b7c5c3c0997547fea2fd36617cabaa7ce9abb56b7ad4bfec02d79589dbb58e2fb4546f5fc8dccbd8bfa061dffb58587b1de120c69d
SSDEEP

768:JG8d+mcbZgP8YlTgPf3Da5ynDNvSi/TWQCG5nVgtw:Jh3clzYmkinWHGDg2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	2508	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2632	2508	40075ac532b5213f6117d80829161c80.exe	28
PID 2508 wrote to memory of 2632	2508	40075ac532b5213f6117d80829161c80.exe	28
PID 2508 wrote to memory of 2632	2508	40075ac532b5213f6117d80829161c80.exe	28
PID 2508 wrote to memory of 2632	2508	40075ac532b5213f6117d80829161c80.exe	28

C:\Users\Admin\AppData\Local\Temp\40075ac532b5213f6117d80829161c80.exe
"C:\Users\Admin\AppData\Local\Temp\40075ac532b5213f6117d80829161c80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 36
  2⤵
  - Program crash
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2508-1-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download