345fc2d36366e1c9ac6b47d6de633d100e482857a97a7d62db7ce78eb1f9bfa2 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 03:37

Sharing

Report Analysis Logs

General

Target

452e4910ae0a473c234b30c2f3533bbe.exe
Size

461KB
MD5

452e4910ae0a473c234b30c2f3533bbe
SHA1

bb0c7195a356f82822dae4fd13c30b73f2935bee
SHA256

345fc2d36366e1c9ac6b47d6de633d100e482857a97a7d62db7ce78eb1f9bfa2
SHA512

cee6663dccff90f05814b4e12d5bb41629df9fe739edcd6d0f54c55b8ca613abe05a836f3c774e9b0f6a5e5ffcbe72098eba267b5e447273d55c2bd467e6d23c
SSDEEP

12288:0CHvEXJw60tDiHbRpMYEaiD2p4Rk5AdsKyU4sv:0C8XNUDiUYEauR6AdsKyUh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1632	3048	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1632	3048	452e4910ae0a473c234b30c2f3533bbe.exe	14
PID 3048 wrote to memory of 1632	3048	452e4910ae0a473c234b30c2f3533bbe.exe	14
PID 3048 wrote to memory of 1632	3048	452e4910ae0a473c234b30c2f3533bbe.exe	14
PID 3048 wrote to memory of 1632	3048	452e4910ae0a473c234b30c2f3533bbe.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 88
1⤵
- Program crash
PID:1632

C:\Users\Admin\AppData\Local\Temp\452e4910ae0a473c234b30c2f3533bbe.exe
"C:\Users\Admin\AppData\Local\Temp\452e4910ae0a473c234b30c2f3533bbe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-0-0x0000000000400000-0x00000000004CC200-memory.dmp

Filesize
816KB

Download