7dac1231b5a0598a13598d98fa57b1b0f8a1541e0b4a65a7998f676f14112a09 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

668e35b60a1db495ea8e087212b1dacb.exe
Size

608KB
MD5

668e35b60a1db495ea8e087212b1dacb
SHA1

5bbf41cbad347e4f99278a03dd10cfb86a1a4ff6
SHA256

7dac1231b5a0598a13598d98fa57b1b0f8a1541e0b4a65a7998f676f14112a09
SHA512

71c0c66f57ef994e1e5e0aac07035c161b6094ed6d3b52e146614026c53bcdf0aa6a0a685677663b9956581a73ff019c4979a63f540b64f75df2d9d805e94b87
SSDEEP

12288:EBEVHoriiX9uIAEkkxY9RB+rzELPZNLXqs76P:EBbL9uh9RB+cLPZRR76P

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	3068	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2152	3068	668e35b60a1db495ea8e087212b1dacb.exe	28
PID 3068 wrote to memory of 2152	3068	668e35b60a1db495ea8e087212b1dacb.exe	28
PID 3068 wrote to memory of 2152	3068	668e35b60a1db495ea8e087212b1dacb.exe	28
PID 3068 wrote to memory of 2152	3068	668e35b60a1db495ea8e087212b1dacb.exe	28

C:\Users\Admin\AppData\Local\Temp\668e35b60a1db495ea8e087212b1dacb.exe
"C:\Users\Admin\AppData\Local\Temp\668e35b60a1db495ea8e087212b1dacb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 204
  2⤵
  - Program crash
  PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-0-0x0000000000DD0000-0x0000000000E6F000-memory.dmp

Filesize
636KB

Download
memory/3068-1-0x0000000000DD0000-0x0000000000E6F000-memory.dmp

Filesize
636KB

Download