afc9e0332857866d5f21039d44eb0fab70fda8966e8b17d90792b6dace262a2b | Triage

Analysis

max time kernel
184s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2024 16:12

Sharing

Report Analysis Logs

General

Target

41523d2f6d57bfa75930845b284fe816.exe
Size

84KB
MD5

41523d2f6d57bfa75930845b284fe816
SHA1

0939fcf035c5a4fde6d4673ad971d0b39e31fdd9
SHA256

afc9e0332857866d5f21039d44eb0fab70fda8966e8b17d90792b6dace262a2b
SHA512

8395683f8ef2f4b791c1d7bfb763febe5b6136b61dc9fcad3a78647da1f6a4c99761becb0e71b4d4019b970890865335881396500be71ebd71b485d457bcd086
SSDEEP

1536:LZXIITaO1l9BOBaqCxf2o3ZW3q2yDGatBLxMgV9:xh9qtXSBLSs

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1236	2452	WerFault.exe	85
3096	2452	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1236	2452	41523d2f6d57bfa75930845b284fe816.exe	92
PID 2452 wrote to memory of 1236	2452	41523d2f6d57bfa75930845b284fe816.exe	92
PID 2452 wrote to memory of 1236	2452	41523d2f6d57bfa75930845b284fe816.exe	92

C:\Users\Admin\AppData\Local\Temp\41523d2f6d57bfa75930845b284fe816.exe
"C:\Users\Admin\AppData\Local\Temp\41523d2f6d57bfa75930845b284fe816.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 288
  2⤵
  - Program crash
  PID:1236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 288
  2⤵
  - Program crash
  PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2452 -ip 2452
1⤵
PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads