d4bdc83e0d6395121cbd98cce8c4f74aec7903e201537399bcd7f2827a4cd8f0 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 01:48

Sharing

Report Analysis Logs

General

Target

4d057fc13c7367ba3e11d2beb3f4b030.exe
Size

446KB
MD5

4d057fc13c7367ba3e11d2beb3f4b030
SHA1

c054a64023d74ba1a4cd3792e302ec90ac66f486
SHA256

d4bdc83e0d6395121cbd98cce8c4f74aec7903e201537399bcd7f2827a4cd8f0
SHA512

3518f4fbf7ac3ac7528217d4db25373c2c3d92c7c186890cc706fc723dab76f9132555ec9b92cedbf2ee5c1870b883de6cd5479ddd29909e5c1eeaac1a9aad6f
SSDEEP

12288:GJMMCTLmC9o1c2obY772efOuLN6DZJK1FB7vZA:GJ5CTV6ocn2N7CBFA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1856	2072	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1856	2072	4d057fc13c7367ba3e11d2beb3f4b030.exe	28
PID 2072 wrote to memory of 1856	2072	4d057fc13c7367ba3e11d2beb3f4b030.exe	28
PID 2072 wrote to memory of 1856	2072	4d057fc13c7367ba3e11d2beb3f4b030.exe	28
PID 2072 wrote to memory of 1856	2072	4d057fc13c7367ba3e11d2beb3f4b030.exe	28

C:\Users\Admin\AppData\Local\Temp\4d057fc13c7367ba3e11d2beb3f4b030.exe
"C:\Users\Admin\AppData\Local\Temp\4d057fc13c7367ba3e11d2beb3f4b030.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 36
  2⤵
  - Program crash
  PID:1856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-0-0x0000000000010000-0x000000000008A000-memory.dmp

Filesize
488KB

Download
memory/2072-1-0x0000000000010000-0x000000000008A000-memory.dmp

Filesize
488KB

Download