009e0f817e693e9a49486d9f2928daa9f4465762a7e5cd0a2f1df9afc8b5f1a6 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

57cd0553826314b59fb0928834fe0035.exe
Size

820KB
MD5

57cd0553826314b59fb0928834fe0035
SHA1

9b8d8cb0e036b3905745dccd1d0b4c83f6571b6c
SHA256

009e0f817e693e9a49486d9f2928daa9f4465762a7e5cd0a2f1df9afc8b5f1a6
SHA512

33a3dadb83021bb9aaf1b8a82042ff0eca5169d29f45c397aa7aeafeb1d7c596611b645c60aa1f39399a9eb7d130ac948efa3afaa9c0230b7bbdc9c5d0c2e4ae
SSDEEP

24576:T6+1vTV7MSc49YyBM2jarIZC7qkpLIdPa6:TB1vTRMf49YR0vA/LIv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2008	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2540	2008	57cd0553826314b59fb0928834fe0035.exe	29
PID 2008 wrote to memory of 2540	2008	57cd0553826314b59fb0928834fe0035.exe	29
PID 2008 wrote to memory of 2540	2008	57cd0553826314b59fb0928834fe0035.exe	29
PID 2008 wrote to memory of 2540	2008	57cd0553826314b59fb0928834fe0035.exe	29

C:\Users\Admin\AppData\Local\Temp\57cd0553826314b59fb0928834fe0035.exe
"C:\Users\Admin\AppData\Local\Temp\57cd0553826314b59fb0928834fe0035.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 72
  2⤵
  - Program crash
  PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads