d97d0de2215dd79f36027d03f9bfb7aa8f4b1bfe74931e9202bd49073c93e3ed | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 19:12

Sharing

Report Analysis Logs

General

Target

65d13a61f1d770d3bedde16d3b324947.exe
Size

125KB
MD5

65d13a61f1d770d3bedde16d3b324947
SHA1

3887dc1c06299b8f64306b91c3e23b512d3b3231
SHA256

d97d0de2215dd79f36027d03f9bfb7aa8f4b1bfe74931e9202bd49073c93e3ed
SHA512

95b7f7c2318d56f973c6435bdde14e74b385edc182b92c4fadc13f1035cf576a625da2f432c8cb52fa988cf88e9e12a3aee82e61f02cce63eac90a1817da1fa1
SSDEEP

3072:IkFY6zbmoJPDoyg+4J1wU3yhohD3Hy1d7Tz9:9v1p6+4Jhd3HyDX9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	1672	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2628	1672	65d13a61f1d770d3bedde16d3b324947.exe	28
PID 1672 wrote to memory of 2628	1672	65d13a61f1d770d3bedde16d3b324947.exe	28
PID 1672 wrote to memory of 2628	1672	65d13a61f1d770d3bedde16d3b324947.exe	28
PID 1672 wrote to memory of 2628	1672	65d13a61f1d770d3bedde16d3b324947.exe	28

C:\Users\Admin\AppData\Local\Temp\65d13a61f1d770d3bedde16d3b324947.exe
"C:\Users\Admin\AppData\Local\Temp\65d13a61f1d770d3bedde16d3b324947.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 36
  2⤵
  - Program crash
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download