07b977b35942e20829f632fd790032c75f8293900813e6f83a20f2bb0280b244 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 17:47

Sharing

Report Analysis Logs

General

Target

file.exe
Size

32KB
MD5

3815abc79e3c096b28895f08b7989124
SHA1

8f1dd8631aa80272d0cf7e8e37d5664b6da3ce2e
SHA256

0f3b85163045b2388f961c9be8f1eeb4025b5163a1424a0faf21d3ade908c179
SHA512

0ef50db2d90766f939f8df6233152a3d8af78f1952faf062151c551d1f5926a310e2b7043e2f97ae4a365491651e9b0b5d26bc0d64468a87ec6b7dabb034a85a
SSDEEP

768:gJRbew8Le1ZDUNAVh2foRV77CtH65kNx8UFSNK:yZr1RUmXDVvKH66HF8K

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2548	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2364	2548	file.exe	28
PID 2548 wrote to memory of 2364	2548	file.exe	28
PID 2548 wrote to memory of 2364	2548	file.exe	28
PID 2548 wrote to memory of 2364	2548	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 144
  2⤵
  - Program crash
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download