8ce94626e1c87b5ffd4443c3a30218e9be751de67aa36c3059885ab7b22c93a4 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 19:11

Sharing

Report Analysis Logs

General

Target

49359f59e4941691a830ca441c3a2e2a.exe
Size

268KB
MD5

49359f59e4941691a830ca441c3a2e2a
SHA1

ab279487771fad534d51cbf093728e19f7b2bb8b
SHA256

8ce94626e1c87b5ffd4443c3a30218e9be751de67aa36c3059885ab7b22c93a4
SHA512

22b03d2eb82068908919c1e062a63a234fc2e896d74e70a41dd43c7edafede631e08b482d9c8d7d5413a02666af9622a3e9af193b5c7bddb95e4f780a6defeda
SSDEEP

6144:6avaH8cS1kVZBr40ZhdOBL0vvIIhAOmkXkKAM:7RrqBr40raI1jUKAM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3056	3000	49359f59e4941691a830ca441c3a2e2a.exe	28
PID 3000 wrote to memory of 3056	3000	49359f59e4941691a830ca441c3a2e2a.exe	28
PID 3000 wrote to memory of 3056	3000	49359f59e4941691a830ca441c3a2e2a.exe	28
PID 3000 wrote to memory of 3056	3000	49359f59e4941691a830ca441c3a2e2a.exe	28
PID 3000 wrote to memory of 3056	3000	49359f59e4941691a830ca441c3a2e2a.exe	28
PID 3000 wrote to memory of 3056	3000	49359f59e4941691a830ca441c3a2e2a.exe	28
PID 3000 wrote to memory of 3056	3000	49359f59e4941691a830ca441c3a2e2a.exe	28

C:\Users\Admin\AppData\Local\Temp\49359f59e4941691a830ca441c3a2e2a.exe
"C:\Users\Admin\AppData\Local\Temp\49359f59e4941691a830ca441c3a2e2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 320
  2⤵
  - Program crash
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3000-1-0x0000000000270000-0x00000000002B3000-memory.dmp

Filesize
268KB

Download