a6675adcfda2c18ecd0769f64daf83f4fd2b89c6425876828796d864b64a6406 | Triage

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 16:34

Sharing

Report Analysis Logs

General

Target

4bec625a6900491dc7c2e4d653eb0b7d.exe
Size

26KB
MD5

4bec625a6900491dc7c2e4d653eb0b7d
SHA1

969c5646a8561c6ac8136bff008480d85204c414
SHA256

a6675adcfda2c18ecd0769f64daf83f4fd2b89c6425876828796d864b64a6406
SHA512

0b527ecf8f4dc94c01815526135a439f9d169aafe9223cf7f0e383c454bc22b3e8ee2701efd63838ff4d3e146a30030fc8e54e1f292566f3384c01a81137ca04
SSDEEP

768:518pCQGZF47Ac8FRyHyRjjUvXI37zkvD:P8pCZU7lCRYccK74D

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2180	WerFault.exe	4

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2644	2180	4bec625a6900491dc7c2e4d653eb0b7d.exe	28
PID 2180 wrote to memory of 2644	2180	4bec625a6900491dc7c2e4d653eb0b7d.exe	28
PID 2180 wrote to memory of 2644	2180	4bec625a6900491dc7c2e4d653eb0b7d.exe	28
PID 2180 wrote to memory of 2644	2180	4bec625a6900491dc7c2e4d653eb0b7d.exe	28

C:\Users\Admin\AppData\Local\Temp\4bec625a6900491dc7c2e4d653eb0b7d.exe
"C:\Users\Admin\AppData\Local\Temp\4bec625a6900491dc7c2e4d653eb0b7d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 116
  2⤵
  - Program crash
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2180-2-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/2180-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download