8b1ded121834830cf98042763fe3d3ef214121796daa3c7eeb04b865ebe24beb | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

438c9706c522c702314ed8be48416011.exe
Size

20KB
MD5

438c9706c522c702314ed8be48416011
SHA1

fc5b22a92861d695d5fb99cb9782728c20a0d952
SHA256

8b1ded121834830cf98042763fe3d3ef214121796daa3c7eeb04b865ebe24beb
SHA512

b8b75875d9e548499c9d2e57cf3b0c5b43f262ce116c4f020522fae5859163ba8aeaee79fc81d163b9e3b46df2a26878c73de65bc2507949a9f3cee3a44ba86c
SSDEEP

384:1vqCX6u0CvD+hA15HL+KggYrthj8hBfweQx9YyUKS:1vbKmvDBPHL+KTeh8aS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1084	2124	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1084	2124	438c9706c522c702314ed8be48416011.exe	14
PID 2124 wrote to memory of 1084	2124	438c9706c522c702314ed8be48416011.exe	14
PID 2124 wrote to memory of 1084	2124	438c9706c522c702314ed8be48416011.exe	14
PID 2124 wrote to memory of 1084	2124	438c9706c522c702314ed8be48416011.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 116
1⤵
- Program crash
PID:1084

C:\Users\Admin\AppData\Local\Temp\438c9706c522c702314ed8be48416011.exe
"C:\Users\Admin\AppData\Local\Temp\438c9706c522c702314ed8be48416011.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-1-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/2124-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2124-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download