e001aa5df65a3639f63d35e516ba49dac89cde8f2e11dabf989ffa1927b1b844 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 02:19

Sharing

Report Analysis Logs

General

Target

57ba4912bfb9cd0c5f9491967a941e04.exe
Size

5KB
MD5

57ba4912bfb9cd0c5f9491967a941e04
SHA1

0168b2259152ee9ec067bbdd27eb1edd87baa868
SHA256

e001aa5df65a3639f63d35e516ba49dac89cde8f2e11dabf989ffa1927b1b844
SHA512

ab26701d2d3af03c382da351634ef6a4319fa317b8e72cf27f6e5c4166ae55fc61eb3f06c04bf2b26fbd61116cfa97f305ac73e1a4bc0590798b4d11ec0d1d5c
SSDEEP

96:nQvDzPLfGKG3ljAvWC61WnV+X/IimmKf9m7LwZRe:nwjrW3l0vdV+vW3f9ocZRe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1656	1728	57ba4912bfb9cd0c5f9491967a941e04.exe	28
PID 1728 wrote to memory of 1656	1728	57ba4912bfb9cd0c5f9491967a941e04.exe	28
PID 1728 wrote to memory of 1656	1728	57ba4912bfb9cd0c5f9491967a941e04.exe	28
PID 1728 wrote to memory of 1656	1728	57ba4912bfb9cd0c5f9491967a941e04.exe	28

C:\Users\Admin\AppData\Local\Temp\57ba4912bfb9cd0c5f9491967a941e04.exe
"C:\Users\Admin\AppData\Local\Temp\57ba4912bfb9cd0c5f9491967a941e04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 52
  2⤵
  - Program crash
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1728-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1728-2-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download