44ff71b18f2bd1112d28ac803be31e67f7e5546ac8660e0e534c32bbdad6abb6 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 07:50

Sharing

Report Analysis Logs

General

Target

55e453aa298b3a7de4d3e3cd0efb7c6f.exe
Size

9KB
MD5

55e453aa298b3a7de4d3e3cd0efb7c6f
SHA1

de75d4a198c704fce10f55a2e6fb1e6f534c78be
SHA256

44ff71b18f2bd1112d28ac803be31e67f7e5546ac8660e0e534c32bbdad6abb6
SHA512

13ff9216e8e661f92af54f5d4f2c9fa77c7fa457f91a4eb67db411e09f3cdca46115a7efdbfe52530bd4ea617ae19cac793de85c999a8160e14f7fec98647ac0
SSDEEP

192:WmSt9yJ09U07krLw3Jv41fBvPmK3OqRsH:Wm2yKlgrE4FBvPTOEs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	1032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3008	1032	55e453aa298b3a7de4d3e3cd0efb7c6f.exe	29
PID 1032 wrote to memory of 3008	1032	55e453aa298b3a7de4d3e3cd0efb7c6f.exe	29
PID 1032 wrote to memory of 3008	1032	55e453aa298b3a7de4d3e3cd0efb7c6f.exe	29
PID 1032 wrote to memory of 3008	1032	55e453aa298b3a7de4d3e3cd0efb7c6f.exe	29

C:\Users\Admin\AppData\Local\Temp\55e453aa298b3a7de4d3e3cd0efb7c6f.exe
"C:\Users\Admin\AppData\Local\Temp\55e453aa298b3a7de4d3e3cd0efb7c6f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 528
  2⤵
  - Program crash
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-0-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/1032-1-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/1032-2-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download