81e5e793f34c897b0e535d922e5c0a5561ec9d50c699e5b90f93fd3ee1ae2413 | Triage

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 21:27

Sharing

Report Analysis Logs

General

Target

549fa3af082710de897262d8c4cd8ec9.exe
Size

56KB
MD5

549fa3af082710de897262d8c4cd8ec9
SHA1

63d21cfec6074686f1042063c5efe9c9dba5b3b3
SHA256

81e5e793f34c897b0e535d922e5c0a5561ec9d50c699e5b90f93fd3ee1ae2413
SHA512

0816275ba15c4f19005a664b8709656a679ef09665b277e546fa8bc45d5abe61a3972ac49c52ea1924906456e60c61f83a44601376f151383c2861c88a113ba2
SSDEEP

1536:/9wBIbzVWulRT8FxHtALW9osO1qTfB9C4:mBIb55lRTQxHtk91qLTL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	1544	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1692	1544	549fa3af082710de897262d8c4cd8ec9.exe	16
PID 1544 wrote to memory of 1692	1544	549fa3af082710de897262d8c4cd8ec9.exe	16
PID 1544 wrote to memory of 1692	1544	549fa3af082710de897262d8c4cd8ec9.exe	16
PID 1544 wrote to memory of 1692	1544	549fa3af082710de897262d8c4cd8ec9.exe	16

C:\Users\Admin\AppData\Local\Temp\549fa3af082710de897262d8c4cd8ec9.exe
"C:\Users\Admin\AppData\Local\Temp\549fa3af082710de897262d8c4cd8ec9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 140
  2⤵
  - Program crash
  PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1544-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download