ba15a9ded2f7ac4083b68414adfd8fb3233027e9628ed01dd4dc91cd98a3e2f3 | Triage

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 17:03

Sharing

Report Analysis Logs

General

Target

4bfbebbc188e38fe1b3ca7abd7685c74.exe
Size

132KB
MD5

4bfbebbc188e38fe1b3ca7abd7685c74
SHA1

2cf3472462fcda446db977cef9740f4f55315d7d
SHA256

ba15a9ded2f7ac4083b68414adfd8fb3233027e9628ed01dd4dc91cd98a3e2f3
SHA512

19bdbff85c7e4fe59836123f0739b0175172b022e0d14ffb296b60222d8f355c1afa90042f4501f67070a591a556dcf5c725ccd633fbd4239aa457ec1c39e326
SSDEEP

3072:RTih3bvZwZGia3QuSk23l3ovC/IWeGG0w6:Zih3dwZPagY23l/gWDG0w

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1036	2132	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1036	2132	4bfbebbc188e38fe1b3ca7abd7685c74.exe	14
PID 2132 wrote to memory of 1036	2132	4bfbebbc188e38fe1b3ca7abd7685c74.exe	14
PID 2132 wrote to memory of 1036	2132	4bfbebbc188e38fe1b3ca7abd7685c74.exe	14
PID 2132 wrote to memory of 1036	2132	4bfbebbc188e38fe1b3ca7abd7685c74.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 36
1⤵
- Program crash
PID:1036

C:\Users\Admin\AppData\Local\Temp\4bfbebbc188e38fe1b3ca7abd7685c74.exe
"C:\Users\Admin\AppData\Local\Temp\4bfbebbc188e38fe1b3ca7abd7685c74.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2132-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2132-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download