b98182a9c070a149a9d33126ef554246e0fc6d94e7c577659db46e1d6b24ab5f | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 12:16

Sharing

Report Analysis Logs

General

Target

5b36b0bbf21c6ebaff49e05beb082a00.exe
Size

227KB
MD5

5b36b0bbf21c6ebaff49e05beb082a00
SHA1

60f9a836bc776064e92859db4cc7cfa005dd09ac
SHA256

b98182a9c070a149a9d33126ef554246e0fc6d94e7c577659db46e1d6b24ab5f
SHA512

7696723d0f1e0ef55232841c9786059c15ef13d2f7650e470f2c9a089e15a672692d09eb56a9b5afc3a77d3d0f991a4f34e1e08e7bbc541fbfc9df17e14cac79
SSDEEP

6144:ALRFGRH1hoj4Oe6bgdlsyE5LxR1YNBGoO:ALRFG51hBe0rNwH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	2176	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2876	2176	5b36b0bbf21c6ebaff49e05beb082a00.exe	28
PID 2176 wrote to memory of 2876	2176	5b36b0bbf21c6ebaff49e05beb082a00.exe	28
PID 2176 wrote to memory of 2876	2176	5b36b0bbf21c6ebaff49e05beb082a00.exe	28
PID 2176 wrote to memory of 2876	2176	5b36b0bbf21c6ebaff49e05beb082a00.exe	28

C:\Users\Admin\AppData\Local\Temp\5b36b0bbf21c6ebaff49e05beb082a00.exe
"C:\Users\Admin\AppData\Local\Temp\5b36b0bbf21c6ebaff49e05beb082a00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 100
  2⤵
  - Program crash
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads