747a18c99a1f87824fc966febf8517d280dcac2e9f358128fd8e0dedb63aed74 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 20:10

Sharing

Report Analysis Logs

General

Target

54772a3bf7a1babcb754b204761ccb98.exe
Size

78KB
MD5

54772a3bf7a1babcb754b204761ccb98
SHA1

9e094c7655a8d62b42624cd2693505937dd19c56
SHA256

747a18c99a1f87824fc966febf8517d280dcac2e9f358128fd8e0dedb63aed74
SHA512

b29ea0b714f47b71b6c914c21913b6353762240b05668096ccca84d1f36ec9d1707d81f39ce7ea7ff074cc74837258571a3edb6983d6f4a419e7e37124105ea5
SSDEEP

1536:/Y1+iv/zc3TE3SrxwFBqB2VXHhTsKYxDeB:++iv/g43SN+BqB2VXBTsKYxDeB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2312	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2072	2312	54772a3bf7a1babcb754b204761ccb98.exe	28
PID 2312 wrote to memory of 2072	2312	54772a3bf7a1babcb754b204761ccb98.exe	28
PID 2312 wrote to memory of 2072	2312	54772a3bf7a1babcb754b204761ccb98.exe	28
PID 2312 wrote to memory of 2072	2312	54772a3bf7a1babcb754b204761ccb98.exe	28

C:\Users\Admin\AppData\Local\Temp\54772a3bf7a1babcb754b204761ccb98.exe
"C:\Users\Admin\AppData\Local\Temp\54772a3bf7a1babcb754b204761ccb98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 140
  2⤵
  - Program crash
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download