cf31f71083fae12bdb1a697880da614d8ad92fdc2a067d4b5fb777ae420d4bea | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 07:47

Sharing

Report Analysis Logs

General

Target

4ada9d8c2cf84437a66d127f05af62db.exe
Size

25KB
MD5

4ada9d8c2cf84437a66d127f05af62db
SHA1

a723ad9c340128786455267f14601ceb4b8eab31
SHA256

cf31f71083fae12bdb1a697880da614d8ad92fdc2a067d4b5fb777ae420d4bea
SHA512

13695170e5b111a11ade71662a311038db413b12de86ada1dd2475247d4e20b59a12f67346527ee9b71a6219a6d49dc77170fbcc3be02f2af2fdc9681b0f0bb7
SSDEEP

768:W+gALi/deTYI1XDa9D/jfQcnvRBBVoBalU:WdALi/dvI1XDID7Qcv3BFlU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2680	2844	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2680	2844	4ada9d8c2cf84437a66d127f05af62db.exe	14
PID 2844 wrote to memory of 2680	2844	4ada9d8c2cf84437a66d127f05af62db.exe	14
PID 2844 wrote to memory of 2680	2844	4ada9d8c2cf84437a66d127f05af62db.exe	14
PID 2844 wrote to memory of 2680	2844	4ada9d8c2cf84437a66d127f05af62db.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 48
1⤵
- Program crash
PID:2680

C:\Users\Admin\AppData\Local\Temp\4ada9d8c2cf84437a66d127f05af62db.exe
"C:\Users\Admin\AppData\Local\Temp\4ada9d8c2cf84437a66d127f05af62db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads