fc30b5ec4b677a68f09ac294ffc840884a1ad5658f6251a4a347c835aba33a83 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a6f7ed38562d097cc83d9fe7944c351.exe
Size

51KB
MD5

5a6f7ed38562d097cc83d9fe7944c351
SHA1

df3b0343e247f063c6ff1073110ba511c447a633
SHA256

fc30b5ec4b677a68f09ac294ffc840884a1ad5658f6251a4a347c835aba33a83
SHA512

c9980cdec2005beb08bb3d9f24e6ac065abf34777637e566f449fbb86a40bb924048ce357309b83ac34058f6e71acff0b9824933568235a64ddfea0b43304fda
SSDEEP

1536:GaKxgIndHWIh7CVdkL2UoV8nFpE2geNgMn:A/dH1dckL/nL5n

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2536	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2456	2536	5a6f7ed38562d097cc83d9fe7944c351.exe	28
PID 2536 wrote to memory of 2456	2536	5a6f7ed38562d097cc83d9fe7944c351.exe	28
PID 2536 wrote to memory of 2456	2536	5a6f7ed38562d097cc83d9fe7944c351.exe	28
PID 2536 wrote to memory of 2456	2536	5a6f7ed38562d097cc83d9fe7944c351.exe	28

C:\Users\Admin\AppData\Local\Temp\5a6f7ed38562d097cc83d9fe7944c351.exe
"C:\Users\Admin\AppData\Local\Temp\5a6f7ed38562d097cc83d9fe7944c351.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 36
  2⤵
  - Program crash
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-0-0x0000000013140000-0x000000001317D000-memory.dmp

Filesize
244KB

Download