4ce5e7a3184f08158b686c2eae814f78008c0924faf0ce6a7023d9a6f67bacfd | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 04:30

Sharing

Report Analysis Logs

General

Target

42c373cb41877fe433b6364120d6503b.exe
Size

77KB
MD5

42c373cb41877fe433b6364120d6503b
SHA1

3ca032a2b0229e9a1830cb1497b62fd02f2c2a5e
SHA256

4ce5e7a3184f08158b686c2eae814f78008c0924faf0ce6a7023d9a6f67bacfd
SHA512

74f3cfc95c4d2987219d382b36df53fc566d331cc8b87546bfd4ebb7ec1f8a6f5d7206cd3b72503d76224dd2bd6bcd7b0b0e70127482b5fd92d93d04274e2796
SSDEEP

1536:joxLOB0udUEkkcoPsbTOqawbcqOi1iYm+LBlmqeY1z:uLOB0udUadeqQikFReYx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1708	2032	42c373cb41877fe433b6364120d6503b.exe	28
PID 2032 wrote to memory of 1708	2032	42c373cb41877fe433b6364120d6503b.exe	28
PID 2032 wrote to memory of 1708	2032	42c373cb41877fe433b6364120d6503b.exe	28
PID 2032 wrote to memory of 1708	2032	42c373cb41877fe433b6364120d6503b.exe	28

C:\Users\Admin\AppData\Local\Temp\42c373cb41877fe433b6364120d6503b.exe
"C:\Users\Admin\AppData\Local\Temp\42c373cb41877fe433b6364120d6503b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 92
  2⤵
  - Program crash
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads