ad9c8fd5b86108c464ac4c69cdeefedd3f06cde18819d9f2f3c887737612708a | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 11:55

Sharing

Report Analysis Logs

General

Target

462aa2ad1b98a1d305048280f6156807.exe
Size

59KB
MD5

462aa2ad1b98a1d305048280f6156807
SHA1

4881a06b45ebd60f86ca4520e68343b1b0ec1d54
SHA256

ad9c8fd5b86108c464ac4c69cdeefedd3f06cde18819d9f2f3c887737612708a
SHA512

86c402a2b02772180b56d47e9e7d141d2bd070a6042fd0a8955856a4dbc459076c839bbfa12fe76f082f1bccce4b839d999db244c7ff80c8a464ca3c0076f787
SSDEEP

1536:+ZMdjHXJqEeqZFlKuhpaaZV8oayGsUHEUXtU7E:H55qOZFAuhl6JpHg7E

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2640	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2912	2640	462aa2ad1b98a1d305048280f6156807.exe	28
PID 2640 wrote to memory of 2912	2640	462aa2ad1b98a1d305048280f6156807.exe	28
PID 2640 wrote to memory of 2912	2640	462aa2ad1b98a1d305048280f6156807.exe	28
PID 2640 wrote to memory of 2912	2640	462aa2ad1b98a1d305048280f6156807.exe	28

C:\Users\Admin\AppData\Local\Temp\462aa2ad1b98a1d305048280f6156807.exe
"C:\Users\Admin\AppData\Local\Temp\462aa2ad1b98a1d305048280f6156807.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 92
  2⤵
  - Program crash
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download