6eca1f6d4d8bdc713410019193688d57c70eea8db93290fb771857a480e11502 | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 04:58

Sharing

Report Analysis Logs

General

Target

4d656b64af671d3bdcb09b0b086afe3b.exe
Size

2.2MB
MD5

4d656b64af671d3bdcb09b0b086afe3b
SHA1

501cc9935b2ea60e9d15ba380021d10b57f35377
SHA256

6eca1f6d4d8bdc713410019193688d57c70eea8db93290fb771857a480e11502
SHA512

0375515696b42be909a71758b7579ec7958c885259331529bace48ac5eebd23b1f85dacdb7b53043a3017b43e1c0786fe294853f78114420d17e85954920212f
SSDEEP

49152:PeM66LwYy2ZgzByPHFwA2cB/S6OyspFVzOJ:PeM66LwYy2iytwA2WspFte

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	1108	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2196	1108	4d656b64af671d3bdcb09b0b086afe3b.exe	28
PID 1108 wrote to memory of 2196	1108	4d656b64af671d3bdcb09b0b086afe3b.exe	28
PID 1108 wrote to memory of 2196	1108	4d656b64af671d3bdcb09b0b086afe3b.exe	28
PID 1108 wrote to memory of 2196	1108	4d656b64af671d3bdcb09b0b086afe3b.exe	28

C:\Users\Admin\AppData\Local\Temp\4d656b64af671d3bdcb09b0b086afe3b.exe
"C:\Users\Admin\AppData\Local\Temp\4d656b64af671d3bdcb09b0b086afe3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 172
  2⤵
  - Program crash
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-0-0x0000000000400000-0x000000000063F000-memory.dmp

Filesize
2.2MB

Download