8e84de521675caf2e21d6d3874d85f12b3062f444b6be36393ff5c0784ea6d41 | Triage

Analysis

max time kernel
145s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 22:40

Sharing

Report Analysis Logs

General

Target

49f6629071e229186053aefe4bac4a61.exe
Size

110KB
MD5

49f6629071e229186053aefe4bac4a61
SHA1

142be03ac427778c423da93dd05a785357b761d2
SHA256

8e84de521675caf2e21d6d3874d85f12b3062f444b6be36393ff5c0784ea6d41
SHA512

3fdf76ce1c235f4f2f2727ecb49292d76cba5a412a2e62ee849e6345da700a0f18d2ae5a9d8abce272e77d9e5bd2b038e2a13da8a601725c4f0d84dff16eb8ac
SSDEEP

3072:G3+BaOaaFoFims/PZYuuVIaAJyTZ+sKPv:9BaOBoKCeyT8

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3000	1740	WerFault.exe	88
736	1740	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 3000	1740	49f6629071e229186053aefe4bac4a61.exe	96
PID 1740 wrote to memory of 3000	1740	49f6629071e229186053aefe4bac4a61.exe	96
PID 1740 wrote to memory of 3000	1740	49f6629071e229186053aefe4bac4a61.exe	96

C:\Users\Admin\AppData\Local\Temp\49f6629071e229186053aefe4bac4a61.exe
"C:\Users\Admin\AppData\Local\Temp\49f6629071e229186053aefe4bac4a61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 224
  2⤵
  - Program crash
  PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 224
  2⤵
  - Program crash
  PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1740 -ip 1740
1⤵
PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1740-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download