2cefd683fad4adb60ef10af2c0bc4b2e4010f43e8f3950b15f7b5eb2b73bc457 | Triage

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 10:01

Sharing

Report Analysis Logs

General

Target

651b6af2e17d5af3c160b510095116bf.exe
Size

109KB
MD5

651b6af2e17d5af3c160b510095116bf
SHA1

38e7dae070b0ae733def11cd0e091ab09fb4896d
SHA256

2cefd683fad4adb60ef10af2c0bc4b2e4010f43e8f3950b15f7b5eb2b73bc457
SHA512

520ca2d6e9e199e7117cafc71faa4e985ec3fcfc9d9bfc2d845dcf4d5d14a73f1cace877bb8eef4e6a7bd813815c904b621b46194a53e73408ff87305ebe3d31
SSDEEP

3072:teLpo745xsfp6cqKxR2UQHecNPTj32qEI:teLp9+YcqCRbQdcI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	2488	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2104	2488	651b6af2e17d5af3c160b510095116bf.exe	28
PID 2488 wrote to memory of 2104	2488	651b6af2e17d5af3c160b510095116bf.exe	28
PID 2488 wrote to memory of 2104	2488	651b6af2e17d5af3c160b510095116bf.exe	28
PID 2488 wrote to memory of 2104	2488	651b6af2e17d5af3c160b510095116bf.exe	28

C:\Users\Admin\AppData\Local\Temp\651b6af2e17d5af3c160b510095116bf.exe
"C:\Users\Admin\AppData\Local\Temp\651b6af2e17d5af3c160b510095116bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 148
  2⤵
  - Program crash
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2488-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download