a1c000d39342d5d07c925dcce227ba58b25c2ec244b6d8a6e50a514f981e4f84 | Triage

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4674220a2065cd1ec7f9a62180b9a67d.exe
Size

21KB
MD5

4674220a2065cd1ec7f9a62180b9a67d
SHA1

e0f0574cdb9bf3ed95cb4f7b8e05efd6b4d0ff5d
SHA256

a1c000d39342d5d07c925dcce227ba58b25c2ec244b6d8a6e50a514f981e4f84
SHA512

b9c88968fcd1bc64f03fb5bcf0b7c0452371050fdafb0a4be061d7e29e9908cb3edd9a08a83cb55b1f053e58c97da0de211aaea717134ef68908fb790ce2d5ee
SSDEEP

384:dDA2lvjtz56/8WVfmI01Puqiet2N/rXJsS49U/TZ:dlvO/z28Tegj7Z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1316	2672	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1316	2672	4674220a2065cd1ec7f9a62180b9a67d.exe	29
PID 2672 wrote to memory of 1316	2672	4674220a2065cd1ec7f9a62180b9a67d.exe	29
PID 2672 wrote to memory of 1316	2672	4674220a2065cd1ec7f9a62180b9a67d.exe	29
PID 2672 wrote to memory of 1316	2672	4674220a2065cd1ec7f9a62180b9a67d.exe	29

C:\Users\Admin\AppData\Local\Temp\4674220a2065cd1ec7f9a62180b9a67d.exe
"C:\Users\Admin\AppData\Local\Temp\4674220a2065cd1ec7f9a62180b9a67d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 64
  2⤵
  - Program crash
  PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download