149846604f37f283773fddbaecbbc390affd5d0769db83d3cc42f9dfd9a5db2d | Triage

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

473e4f87f45c765928c0f030a9d4c358.exe
Size

97KB
MD5

473e4f87f45c765928c0f030a9d4c358
SHA1

05661eff8872e93b0944e260f36d5b60284188fe
SHA256

149846604f37f283773fddbaecbbc390affd5d0769db83d3cc42f9dfd9a5db2d
SHA512

09f10e0fe786a46e8b389fbdaefd32e40a8716cc79c9ba4a38ec8675091622429298606ee2636e5991a6c83fd772a3913a8324ff4ed03a0aabc466fcf024025d
SSDEEP

3072:/nyypmMGdSuE4CqR21eUK61gwT7hY9gE2:1mMW3CjQ2CwT7ld

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2548	1888	473e4f87f45c765928c0f030a9d4c358.exe	28
PID 1888 wrote to memory of 2548	1888	473e4f87f45c765928c0f030a9d4c358.exe	28
PID 1888 wrote to memory of 2548	1888	473e4f87f45c765928c0f030a9d4c358.exe	28
PID 1888 wrote to memory of 2548	1888	473e4f87f45c765928c0f030a9d4c358.exe	28

C:\Users\Admin\AppData\Local\Temp\473e4f87f45c765928c0f030a9d4c358.exe
"C:\Users\Admin\AppData\Local\Temp\473e4f87f45c765928c0f030a9d4c358.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 88
  2⤵
  - Program crash
  PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x0000000010000000-0x0000000010013200-memory.dmp

Filesize
76KB

Download
memory/1888-1-0x0000000010000000-0x0000000010013200-memory.dmp

Filesize
76KB

Download