ed5c9f3f5b682957599c74669cf2c35175327d39745f5927ce409f21a7ed6241 | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 15:29

Sharing

Report Analysis Logs

General

Target

50ef7d425f52d77b7a1023ecbecf231f.exe
Size

132KB
MD5

50ef7d425f52d77b7a1023ecbecf231f
SHA1

131cc8b40a101615ad1de4eaa9bd7b38aa246252
SHA256

ed5c9f3f5b682957599c74669cf2c35175327d39745f5927ce409f21a7ed6241
SHA512

e0ae0634994de74c2e787d9ded2c58ac79d68cb23a1a11b13ee16ff6b7dcf33978748c59e4317bd41693a6419b26e89658c15d4b3375203cc4569236aba98e71
SSDEEP

3072:k/WSeJqtsZ4Iz49HSl6FZuKHe1G1ESMHmZzXfP:rSsqW6IEd2CMKKGFMG9vP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	1940	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1884	1940	50ef7d425f52d77b7a1023ecbecf231f.exe	16
PID 1940 wrote to memory of 1884	1940	50ef7d425f52d77b7a1023ecbecf231f.exe	16
PID 1940 wrote to memory of 1884	1940	50ef7d425f52d77b7a1023ecbecf231f.exe	16
PID 1940 wrote to memory of 1884	1940	50ef7d425f52d77b7a1023ecbecf231f.exe	16

C:\Users\Admin\AppData\Local\Temp\50ef7d425f52d77b7a1023ecbecf231f.exe
"C:\Users\Admin\AppData\Local\Temp\50ef7d425f52d77b7a1023ecbecf231f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 36
  2⤵
  - Program crash
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download