b787e001ff945520251470f8a5bf51707bd055da6f67856675721fcdaa33ba1f | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 22:30

Sharing

Report Analysis Logs

General

Target

4754eb5f31e063697c4808fc6cc96d36.exe
Size

42KB
MD5

4754eb5f31e063697c4808fc6cc96d36
SHA1

df35f6958782fed9e00fc2a7f59289618e2b14e3
SHA256

b787e001ff945520251470f8a5bf51707bd055da6f67856675721fcdaa33ba1f
SHA512

5594dc9535a07b4fc54972afc14102cb713cf22d1bcc232c441b2d185494fe71a653a6fac561d613b3372e30e864b9b4ddaa2672915604d9fe1d19d8b2308cad
SSDEEP

768:eoIedHRo4pSiL8K8oD3L/72TcSTtc+4+MwiU5M7:eoIedRo4jQKetcciZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	1652	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2372	1652	4754eb5f31e063697c4808fc6cc96d36.exe	28
PID 1652 wrote to memory of 2372	1652	4754eb5f31e063697c4808fc6cc96d36.exe	28
PID 1652 wrote to memory of 2372	1652	4754eb5f31e063697c4808fc6cc96d36.exe	28
PID 1652 wrote to memory of 2372	1652	4754eb5f31e063697c4808fc6cc96d36.exe	28

C:\Users\Admin\AppData\Local\Temp\4754eb5f31e063697c4808fc6cc96d36.exe
"C:\Users\Admin\AppData\Local\Temp\4754eb5f31e063697c4808fc6cc96d36.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 72
  2⤵
  - Program crash
  PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads