1544534e86b4b8139f5bb845a150832eaf0fdf41383af98fa67c07205da4e9a8 | Triage

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 20:04

Sharing

Report Analysis Logs

General

Target

4c56f0423fc10d8bb067d63edf4e9ec5.exe
Size

233KB
MD5

4c56f0423fc10d8bb067d63edf4e9ec5
SHA1

6f5d6bb843773189088789e939b8cdc92c2bdf95
SHA256

1544534e86b4b8139f5bb845a150832eaf0fdf41383af98fa67c07205da4e9a8
SHA512

34ed0a67c6524e27dba5633b5d98fe46df21900fbbb518e15ed933da84ec077af98ed05178fcce058659f1a7d2951e26998e314d2c227eb755a48d5e515ab4a7
SSDEEP

6144:HblIO0WdFny0J4FO1UxXT10M1W3BQFNWiQ:HbVkMUXh0M1NNWP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2752	2540	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2752	2540	4c56f0423fc10d8bb067d63edf4e9ec5.exe	14
PID 2540 wrote to memory of 2752	2540	4c56f0423fc10d8bb067d63edf4e9ec5.exe	14
PID 2540 wrote to memory of 2752	2540	4c56f0423fc10d8bb067d63edf4e9ec5.exe	14
PID 2540 wrote to memory of 2752	2540	4c56f0423fc10d8bb067d63edf4e9ec5.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 120
1⤵
- Program crash
PID:2752

C:\Users\Admin\AppData\Local\Temp\4c56f0423fc10d8bb067d63edf4e9ec5.exe
"C:\Users\Admin\AppData\Local\Temp\4c56f0423fc10d8bb067d63edf4e9ec5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x00000000011F0000-0x0000000001201000-memory.dmp

Filesize
68KB

Download
memory/2540-1-0x00000000011F0000-0x0000000001201000-memory.dmp

Filesize
68KB

Download