6c3357ea72c52462552ba322ee5cff727b7a9a677c8d6cdec7f5af254734c221 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 08:22

Sharing

Report Analysis Logs

General

Target

405dc385380732c5cd3727a4fd001e2c.exe
Size

12KB
MD5

405dc385380732c5cd3727a4fd001e2c
SHA1

b7598b0de2c09d5a103b2339961bc91a1bb70cbd
SHA256

6c3357ea72c52462552ba322ee5cff727b7a9a677c8d6cdec7f5af254734c221
SHA512

0e06858063fcd6a28db8e0b293606b302cb9f3a767c23c8e11da2609bf7924e42d61550acb9584b5cf4149ef310c6de245e261b6507ec7bf8b9d3e3ba307a69d
SSDEEP

96:cbIARbd5GTC9rXhAUu54wu2nNlxh1K71yQtQKQYQ:cbIjTCl6UANff1K7MQjQYQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2392	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2076	2392	405dc385380732c5cd3727a4fd001e2c.exe	28
PID 2392 wrote to memory of 2076	2392	405dc385380732c5cd3727a4fd001e2c.exe	28
PID 2392 wrote to memory of 2076	2392	405dc385380732c5cd3727a4fd001e2c.exe	28
PID 2392 wrote to memory of 2076	2392	405dc385380732c5cd3727a4fd001e2c.exe	28

C:\Users\Admin\AppData\Local\Temp\405dc385380732c5cd3727a4fd001e2c.exe
"C:\Users\Admin\AppData\Local\Temp\405dc385380732c5cd3727a4fd001e2c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 88
  2⤵
  - Program crash
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads