eb868b52b10b97108d4cfeb0cdb0c8d00461fb140e0a606419c58c0e249f694c | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 03:24

Sharing

Report Analysis Logs

General

Target

5a2423cd997f2d9e1df1b99c5160d9b2.exe
Size

136KB
MD5

5a2423cd997f2d9e1df1b99c5160d9b2
SHA1

3450c77c8e81bf1d87e2fc302f5b69abc5dcb2f6
SHA256

eb868b52b10b97108d4cfeb0cdb0c8d00461fb140e0a606419c58c0e249f694c
SHA512

ff562eb0a5506a6bb4b533e241c0430ee8f229cbfd12b222e0dde5447e100170d86e1a9faaf10493b0ee6ba9cb246173060e5059126a3fb380365c88e87ab3e2
SSDEEP

3072:Jz+kVyEtF8RZTrlmfMRDytJXhrimbk92cv:d+kV3bWZT2oq+KkZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2344	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1708	2344	5a2423cd997f2d9e1df1b99c5160d9b2.exe	28
PID 2344 wrote to memory of 1708	2344	5a2423cd997f2d9e1df1b99c5160d9b2.exe	28
PID 2344 wrote to memory of 1708	2344	5a2423cd997f2d9e1df1b99c5160d9b2.exe	28
PID 2344 wrote to memory of 1708	2344	5a2423cd997f2d9e1df1b99c5160d9b2.exe	28

C:\Users\Admin\AppData\Local\Temp\5a2423cd997f2d9e1df1b99c5160d9b2.exe
"C:\Users\Admin\AppData\Local\Temp\5a2423cd997f2d9e1df1b99c5160d9b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 136
  2⤵
  - Program crash
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download