34d543e83548f23e491ace9503eb924773436f9ccd6b84e297afd65c6526c4e6 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 04:22

Sharing

Report Analysis Logs

General

Target

5285bd63e76bab304f187f8f9f83c3e7.exe
Size

36KB
MD5

5285bd63e76bab304f187f8f9f83c3e7
SHA1

35e3460992bbb48b73ac7a59b632da73c1901f65
SHA256

34d543e83548f23e491ace9503eb924773436f9ccd6b84e297afd65c6526c4e6
SHA512

9dd0e35005158ebbd9bbe50bb0f22225c223aa09d4e5b26f6910ccac61a4138f8fbeb0d36bb09356cf2048a4f13d559be63f3acfc058c529a16a8c7043c1b918
SSDEEP

768:wTJPmMEHZlW3vJf+ILCuPLe82Z4tKsfoO92p/x8cmH:wTsrZlmfROuPLe8V3E/i

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	2636	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1124	2636	5285bd63e76bab304f187f8f9f83c3e7.exe	18
PID 2636 wrote to memory of 1124	2636	5285bd63e76bab304f187f8f9f83c3e7.exe	18
PID 2636 wrote to memory of 1124	2636	5285bd63e76bab304f187f8f9f83c3e7.exe	18
PID 2636 wrote to memory of 1124	2636	5285bd63e76bab304f187f8f9f83c3e7.exe	18

C:\Users\Admin\AppData\Local\Temp\5285bd63e76bab304f187f8f9f83c3e7.exe
"C:\Users\Admin\AppData\Local\Temp\5285bd63e76bab304f187f8f9f83c3e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 36
  2⤵
  - Program crash
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-0-0x00000000003E0000-0x0000000000414000-memory.dmp

Filesize
208KB

Download