ac69efe7c37a8d938ee5d9b14049db632763c23448d1f199a9d89ff397c1975d | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4677db998b63ac4ab65c6764e72df28c.exe
Size

51KB
MD5

4677db998b63ac4ab65c6764e72df28c
SHA1

056bc529855688815d72670895de5998cdbf1941
SHA256

ac69efe7c37a8d938ee5d9b14049db632763c23448d1f199a9d89ff397c1975d
SHA512

8a13e91d4c4add18f47bce566f1e8fe59728062465cd1243a5b96c95a6fd3e6c8811f6e5829d0f89045a8d5b6651f84c612b2e40403ad8e033174865ba465b10
SSDEEP

1536:3YG4Rc3eRTovGNK8wyFPcmEE2ImmudXpRxcP:u/toyCETmDf8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2176	1716	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2176	1716	4677db998b63ac4ab65c6764e72df28c.exe	14
PID 1716 wrote to memory of 2176	1716	4677db998b63ac4ab65c6764e72df28c.exe	14
PID 1716 wrote to memory of 2176	1716	4677db998b63ac4ab65c6764e72df28c.exe	14
PID 1716 wrote to memory of 2176	1716	4677db998b63ac4ab65c6764e72df28c.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 88
1⤵
- Program crash
PID:2176

C:\Users\Admin\AppData\Local\Temp\4677db998b63ac4ab65c6764e72df28c.exe
"C:\Users\Admin\AppData\Local\Temp\4677db998b63ac4ab65c6764e72df28c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-0-0x0000000044440000-0x0000000044458000-memory.dmp

Filesize
96KB

Download