76ffc4484e3215cc2cfc1fd5546afb88d928442d672a3ba1950296702582ff13 | Triage

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 01:38

Sharing

Report Analysis Logs

General

Target

4d0096fa3792326fe50ee936361b3fc8.exe
Size

113KB
MD5

4d0096fa3792326fe50ee936361b3fc8
SHA1

9a7178dac790347721273afa0667f9471b8407d0
SHA256

76ffc4484e3215cc2cfc1fd5546afb88d928442d672a3ba1950296702582ff13
SHA512

24a2e0cc9066c1b2662f52c7f3062b1a98c340dc17111a4907dedcdaf1415994f7aa267d601ddbab74de9e273837a18a8700d32071969f60ade811d1ee9cdd4c
SSDEEP

3072:6S+U0yMpjK4oNI/WqZBcO2kYthImuo5Hgc:Z+U0hpK43tZBfK+Fw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	2132	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1724	2132	4d0096fa3792326fe50ee936361b3fc8.exe	28
PID 2132 wrote to memory of 1724	2132	4d0096fa3792326fe50ee936361b3fc8.exe	28
PID 2132 wrote to memory of 1724	2132	4d0096fa3792326fe50ee936361b3fc8.exe	28
PID 2132 wrote to memory of 1724	2132	4d0096fa3792326fe50ee936361b3fc8.exe	28

C:\Users\Admin\AppData\Local\Temp\4d0096fa3792326fe50ee936361b3fc8.exe
"C:\Users\Admin\AppData\Local\Temp\4d0096fa3792326fe50ee936361b3fc8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 36
  2⤵
  - Program crash
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2132-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download