68bb53845f7f5653e8b56da4f80fda57a71a2c5f057d8e82b112be843fc5fcac | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 15:16

Sharing

Report Analysis Logs

General

Target

53dd2bc5ad25e20b23ba0e40ff215905.exe
Size

142KB
MD5

53dd2bc5ad25e20b23ba0e40ff215905
SHA1

77eef02c5f458991c6735f4344fdc4b4cbc85211
SHA256

68bb53845f7f5653e8b56da4f80fda57a71a2c5f057d8e82b112be843fc5fcac
SHA512

52569df7d4c67d8c5a3f6d46a66cc980f0f94d8169ffd5c50a5d76887af3c1fd5fed0bd375e6e162755cbb398032ff9798a23c9e3a73929976ed3f9066bca641
SSDEEP

3072:RBOomsK+hxg4dZxd/54+fRLyumwl4o9wnl9:RBOoHK2xO+fRbm44oun

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2028	2468	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2028	2468	53dd2bc5ad25e20b23ba0e40ff215905.exe	16
PID 2468 wrote to memory of 2028	2468	53dd2bc5ad25e20b23ba0e40ff215905.exe	16
PID 2468 wrote to memory of 2028	2468	53dd2bc5ad25e20b23ba0e40ff215905.exe	16
PID 2468 wrote to memory of 2028	2468	53dd2bc5ad25e20b23ba0e40ff215905.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 36
1⤵
- Program crash
PID:2028

C:\Users\Admin\AppData\Local\Temp\53dd2bc5ad25e20b23ba0e40ff215905.exe
"C:\Users\Admin\AppData\Local\Temp\53dd2bc5ad25e20b23ba0e40ff215905.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download