25f220beb1138cde4e44c4b58916aa4be55010457247402ac5652205ebb64a41 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 14:49

Sharing

Report Analysis Logs

General

Target

43f4e907e9088df1d6cc2642e676a58f.exe
Size

124KB
MD5

43f4e907e9088df1d6cc2642e676a58f
SHA1

8c531b06e412bd0295b574b521e88a3d05c6aca1
SHA256

25f220beb1138cde4e44c4b58916aa4be55010457247402ac5652205ebb64a41
SHA512

03339798972b37679421a8b45bf4e6822e9949b702c4922d3cbcd550200be60622e23c83454c6e64933bd96d89df710624629c97045e7f737e86eef9f1032307
SSDEEP

3072:VlO+nuPyJRqpK0sU0KOETQ4tMex+fYDy4:nbueUDN7UwZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2948	2936	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2948	2936	43f4e907e9088df1d6cc2642e676a58f.exe	16
PID 2936 wrote to memory of 2948	2936	43f4e907e9088df1d6cc2642e676a58f.exe	16
PID 2936 wrote to memory of 2948	2936	43f4e907e9088df1d6cc2642e676a58f.exe	16
PID 2936 wrote to memory of 2948	2936	43f4e907e9088df1d6cc2642e676a58f.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 36
1⤵
- Program crash
PID:2948

C:\Users\Admin\AppData\Local\Temp\43f4e907e9088df1d6cc2642e676a58f.exe
"C:\Users\Admin\AppData\Local\Temp\43f4e907e9088df1d6cc2642e676a58f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download