6cada6b043b8079b071e097d5a985ec102019ee59984dc950fbd1b2810138a7c | Triage

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 08:30

Sharing

Report Analysis Logs

General

Target

5ac64f87e209c2a7f7e85b90007ac6e5.exe
Size

206KB
MD5

5ac64f87e209c2a7f7e85b90007ac6e5
SHA1

4934fe8799fa463dbd9c68fa5dc08ba73f842084
SHA256

6cada6b043b8079b071e097d5a985ec102019ee59984dc950fbd1b2810138a7c
SHA512

dfc7295c6822f0d87ba97dc2322b29c62c3a02363778c9b6238df3cd7a22f0288838a348b49e883006940e203e8f639f41e986f4b46619a18b5eb87e8d8ae3f2
SSDEEP

6144:gqql6XvrLj6vnoJU1BHifuoEa3zSKIk6YxArQLi:eCvj6vnCclgLWe6YaN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	2124	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1300	2124	5ac64f87e209c2a7f7e85b90007ac6e5.exe	28
PID 2124 wrote to memory of 1300	2124	5ac64f87e209c2a7f7e85b90007ac6e5.exe	28
PID 2124 wrote to memory of 1300	2124	5ac64f87e209c2a7f7e85b90007ac6e5.exe	28
PID 2124 wrote to memory of 1300	2124	5ac64f87e209c2a7f7e85b90007ac6e5.exe	28

C:\Users\Admin\AppData\Local\Temp\5ac64f87e209c2a7f7e85b90007ac6e5.exe
"C:\Users\Admin\AppData\Local\Temp\5ac64f87e209c2a7f7e85b90007ac6e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 184
  2⤵
  - Program crash
  PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download