e4c3a4a428ece4f00c848e792b281d95d8febfd83490fa65ae46ceae6754473d | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 05:49

Sharing

Report Analysis Logs

General

Target

64a2010d1857464ae357a24a5dad20c9.exe
Size

28KB
MD5

64a2010d1857464ae357a24a5dad20c9
SHA1

df41376d85d3b2835fa6b6bdbd7e4739131d435d
SHA256

e4c3a4a428ece4f00c848e792b281d95d8febfd83490fa65ae46ceae6754473d
SHA512

c5066e427e65983eaee97ed439f1b8583c0b636e72cacd5167ae51d3465b675fbb9b66ae0d6fc4cfe3ec47782a31f5fb367a4d9b7774e9dbb5055fc47f3618e6
SSDEEP

768:5uogm1MJMzWaJ0LdHdWRqVcLBxK2cefxIL4g6:5u5JiWaJ0LO0VUNfxb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2876	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2196	2876	64a2010d1857464ae357a24a5dad20c9.exe	28
PID 2876 wrote to memory of 2196	2876	64a2010d1857464ae357a24a5dad20c9.exe	28
PID 2876 wrote to memory of 2196	2876	64a2010d1857464ae357a24a5dad20c9.exe	28
PID 2876 wrote to memory of 2196	2876	64a2010d1857464ae357a24a5dad20c9.exe	28

C:\Users\Admin\AppData\Local\Temp\64a2010d1857464ae357a24a5dad20c9.exe
"C:\Users\Admin\AppData\Local\Temp\64a2010d1857464ae357a24a5dad20c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 88
  2⤵
  - Program crash
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download