0258fc17fe9d28582b081de379665dd7a7e0d2053752cdc9022b4b8d7f1dde70 | Triage

Analysis

max time kernel
75s
max time network
41s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 18:49

Sharing

Report Analysis Logs

General

Target

4eef41e33fbeade865f7a2155809bf72.exe
Size

117KB
MD5

4eef41e33fbeade865f7a2155809bf72
SHA1

995cfe761d5dbe89ef586474e94b20fe9d03c621
SHA256

0258fc17fe9d28582b081de379665dd7a7e0d2053752cdc9022b4b8d7f1dde70
SHA512

36827ad23e09a458834d71162b9256f9bd57beb957fc1bd525c3a9d15878d3bb51297406e292079de591d1e13318465d271d886fdb85189daeb7cc8d73fe4e45
SSDEEP

3072:k37TqesNzOJFBqmZxdvAINUa/yWBe6dELoapC6:w+vNSFtZDvbNflvapC6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2636	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2604	2636	4eef41e33fbeade865f7a2155809bf72.exe	29
PID 2636 wrote to memory of 2604	2636	4eef41e33fbeade865f7a2155809bf72.exe	29
PID 2636 wrote to memory of 2604	2636	4eef41e33fbeade865f7a2155809bf72.exe	29
PID 2636 wrote to memory of 2604	2636	4eef41e33fbeade865f7a2155809bf72.exe	29

C:\Users\Admin\AppData\Local\Temp\4eef41e33fbeade865f7a2155809bf72.exe
"C:\Users\Admin\AppData\Local\Temp\4eef41e33fbeade865f7a2155809bf72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 36
  2⤵
  - Program crash
  PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2636-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download