6cf466940aac052420525625acce908b94bb46cbdbdfd04d20bb400c972b18c8 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 10:44

Sharing

Report Analysis Logs

General

Target

58b858e0140557f12967f0bec6732733.exe
Size

24KB
MD5

58b858e0140557f12967f0bec6732733
SHA1

4c88dfc82032959c3d6a05c39e0597555ee8f6b6
SHA256

6cf466940aac052420525625acce908b94bb46cbdbdfd04d20bb400c972b18c8
SHA512

3cac00b316f73e65b39b53bd36ee4f0cc75c7341a2a8b516041395704d94484b0774d8f3d4555ec1efc985d93114bc87481bc56efda773d531ca0cc9cfe05cef
SSDEEP

768:r2O610EVUBPtg7vslPd/P4EeVlOI+n/21d:y7eBPy7UlPZPPevOII/+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2360	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1992	2360	58b858e0140557f12967f0bec6732733.exe	28
PID 2360 wrote to memory of 1992	2360	58b858e0140557f12967f0bec6732733.exe	28
PID 2360 wrote to memory of 1992	2360	58b858e0140557f12967f0bec6732733.exe	28
PID 2360 wrote to memory of 1992	2360	58b858e0140557f12967f0bec6732733.exe	28

C:\Users\Admin\AppData\Local\Temp\58b858e0140557f12967f0bec6732733.exe
"C:\Users\Admin\AppData\Local\Temp\58b858e0140557f12967f0bec6732733.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 88
  2⤵
  - Program crash
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download