22c02c573dce6912b0f1d0502bb3fb3fc1c2f7cd1bb7c4e24f919d095653870d | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 06:05

Sharing

Report Analysis Logs

General

Target

52bcc1686d72a920431a0dc7390a1ce7.exe
Size

24KB
MD5

52bcc1686d72a920431a0dc7390a1ce7
SHA1

44b0db3a9e7b8c2c23947fcce8e3c4a949b76a21
SHA256

22c02c573dce6912b0f1d0502bb3fb3fc1c2f7cd1bb7c4e24f919d095653870d
SHA512

0186b098b7b9b4e790f46caeac2e63499f5bed91cff6b89287971accb16d726cc960511fd02d900fcd62afae02f4097ac2f145d220dbec54d458df9fa4d5c132
SSDEEP

768:AabfECqDjt3yeRShrpWxuUlt7Wm0hUfQ:TEjDjtCRhrpWxuUbW0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	2356	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2096	2356	52bcc1686d72a920431a0dc7390a1ce7.exe	28
PID 2356 wrote to memory of 2096	2356	52bcc1686d72a920431a0dc7390a1ce7.exe	28
PID 2356 wrote to memory of 2096	2356	52bcc1686d72a920431a0dc7390a1ce7.exe	28
PID 2356 wrote to memory of 2096	2356	52bcc1686d72a920431a0dc7390a1ce7.exe	28

C:\Users\Admin\AppData\Local\Temp\52bcc1686d72a920431a0dc7390a1ce7.exe
"C:\Users\Admin\AppData\Local\Temp\52bcc1686d72a920431a0dc7390a1ce7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 88
  2⤵
  - Program crash
  PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download