bf49abc1d52096f6c7c681419ba476e6ca895c71cb90cc4042627a8962a35a13 | Triage

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 12:34

Sharing

Report Analysis Logs

General

Target

4b73a64958b3eb99672fe512ed7ed71f.exe
Size

83KB
MD5

4b73a64958b3eb99672fe512ed7ed71f
SHA1

04bc81644e22d183d14d3e2a7a633106c7f35bd9
SHA256

bf49abc1d52096f6c7c681419ba476e6ca895c71cb90cc4042627a8962a35a13
SHA512

45034f93cbbfd77a1fd566a58c0df53c5c2e1627183ed7848598dada0b88a4f46b6c3a579fb7fb842a2a7dc005427d27fc45e97b7845d9a527d7f17332fc084c
SSDEEP

1536:Io15MzLpvuwjavf5UpLQCRvsmWwr2rOiGMp8qni:h15MzlDa3lCRyO+8ai

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2084	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2992	2084	4b73a64958b3eb99672fe512ed7ed71f.exe	28
PID 2084 wrote to memory of 2992	2084	4b73a64958b3eb99672fe512ed7ed71f.exe	28
PID 2084 wrote to memory of 2992	2084	4b73a64958b3eb99672fe512ed7ed71f.exe	28
PID 2084 wrote to memory of 2992	2084	4b73a64958b3eb99672fe512ed7ed71f.exe	28

C:\Users\Admin\AppData\Local\Temp\4b73a64958b3eb99672fe512ed7ed71f.exe
"C:\Users\Admin\AppData\Local\Temp\4b73a64958b3eb99672fe512ed7ed71f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 88
  2⤵
  - Program crash
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x0000000044440000-0x0000000044458000-memory.dmp

Filesize
96KB

Download