3fe02cbcdffd7c8d8a4afec205001a14a6f557320f0e394b82bf865dcfb5b0bf | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 00:45

Sharing

Report Analysis Logs

General

Target

4ce41c0ae2be80dcfd258360a4af37da.exe
Size

31KB
MD5

4ce41c0ae2be80dcfd258360a4af37da
SHA1

0f87fa40f34e016e0eadb00465a87f07b6d60ca3
SHA256

3fe02cbcdffd7c8d8a4afec205001a14a6f557320f0e394b82bf865dcfb5b0bf
SHA512

3f2691539720e5841cda08a6bc58ed36a2e01d0e78019ba2fb079383b44a965d1c25e066ecbc78b96c21899350c07fdb5237f57e65962699825226bb771c74b9
SSDEEP

768:Znh7TzTBziifTeiZSVWihwEknh0L7OTLeNfQf3:BZ/nEkh8OTKNC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2900	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2072	2900	4ce41c0ae2be80dcfd258360a4af37da.exe	28
PID 2900 wrote to memory of 2072	2900	4ce41c0ae2be80dcfd258360a4af37da.exe	28
PID 2900 wrote to memory of 2072	2900	4ce41c0ae2be80dcfd258360a4af37da.exe	28
PID 2900 wrote to memory of 2072	2900	4ce41c0ae2be80dcfd258360a4af37da.exe	28

C:\Users\Admin\AppData\Local\Temp\4ce41c0ae2be80dcfd258360a4af37da.exe
"C:\Users\Admin\AppData\Local\Temp\4ce41c0ae2be80dcfd258360a4af37da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 88
  2⤵
  - Program crash
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download