caf6ed58c3953288f5a49df396b1585fe04c009afa866c9b10719c58f9102a28 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 01:22

Sharing

Report Analysis Logs

General

Target

551a6df7df73e31291d6ffb29b4ad569.exe
Size

30KB
MD5

551a6df7df73e31291d6ffb29b4ad569
SHA1

d1627a1b72d160d5d2f4598000c3c717d9477e8d
SHA256

caf6ed58c3953288f5a49df396b1585fe04c009afa866c9b10719c58f9102a28
SHA512

7cda0e05e48a09a0fe9616eafdfb3a4f46f29914b2dc3f302a082221d4ad64f2a0cc914147d7853d27841242d263d037e31065fecca1777ecb3b953defb6e860
SSDEEP

768:KVYviHEsgK8unH+J569B8ZM7BPgVj1PfZh/Gf:KVYqke8uzwQB6Pxh+f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	1848	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1736	1848	551a6df7df73e31291d6ffb29b4ad569.exe	28
PID 1848 wrote to memory of 1736	1848	551a6df7df73e31291d6ffb29b4ad569.exe	28
PID 1848 wrote to memory of 1736	1848	551a6df7df73e31291d6ffb29b4ad569.exe	28
PID 1848 wrote to memory of 1736	1848	551a6df7df73e31291d6ffb29b4ad569.exe	28

C:\Users\Admin\AppData\Local\Temp\551a6df7df73e31291d6ffb29b4ad569.exe
"C:\Users\Admin\AppData\Local\Temp\551a6df7df73e31291d6ffb29b4ad569.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 36
  2⤵
  - Program crash
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads