b86b2bdb919e3004cb39006032cc56346fa49d4b9b8ca23686c0bac8a9e142fd | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 09:49

Sharing

Report Analysis Logs

General

Target

5aec74aefa624a6f7794bbe6a152d9d2.exe
Size

13KB
MD5

5aec74aefa624a6f7794bbe6a152d9d2
SHA1

297abe00f0d80d5985ce556d6d3ee105813adb4f
SHA256

b86b2bdb919e3004cb39006032cc56346fa49d4b9b8ca23686c0bac8a9e142fd
SHA512

3a79b50cfc5c032de7087fb1fe56818ff6f7af266ac4cdbb8cfc1012187c73b2843fa78932fe438a089adc02eb1f1ace9bbdf9e09a1ff4df10659b2b16dd39ee
SSDEEP

384:yYQEkiPO0M5tWPrTRQFPGPktWlCn9N1gxIAbM:yYQIPnMDWPmpGMtiG6eAb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2972	WerFault.exe	8

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2644	2972	5aec74aefa624a6f7794bbe6a152d9d2.exe	28
PID 2972 wrote to memory of 2644	2972	5aec74aefa624a6f7794bbe6a152d9d2.exe	28
PID 2972 wrote to memory of 2644	2972	5aec74aefa624a6f7794bbe6a152d9d2.exe	28
PID 2972 wrote to memory of 2644	2972	5aec74aefa624a6f7794bbe6a152d9d2.exe	28

C:\Users\Admin\AppData\Local\Temp\5aec74aefa624a6f7794bbe6a152d9d2.exe
"C:\Users\Admin\AppData\Local\Temp\5aec74aefa624a6f7794bbe6a152d9d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 88
  2⤵
  - Program crash
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2972-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download