e50be45f82f81bc117d9098337428edaba711deb77bab382a7b532055bb602e1 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 12:17

Sharing

Report Analysis Logs

General

Target

679a6c4fc295a2fabb6a48f01dec6c55.exe
Size

904KB
MD5

679a6c4fc295a2fabb6a48f01dec6c55
SHA1

a030ba30aaccd949c374227746f317be7c711a2b
SHA256

e50be45f82f81bc117d9098337428edaba711deb77bab382a7b532055bb602e1
SHA512

bdc32c283b737e5d061c24f06fcf8cbe64a558a0425f0a531d378b829842482dd9555a6380ebe02c0eac50d77069218eb272e0041cb25c516cf9ed37732fda13
SSDEEP

3072:ft2cWtTBfVkfqM2SCAygRjlIqZoFzJcq2:hWtTBdsqEPxjjoFz8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	2404	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2452	2404	679a6c4fc295a2fabb6a48f01dec6c55.exe	28
PID 2404 wrote to memory of 2452	2404	679a6c4fc295a2fabb6a48f01dec6c55.exe	28
PID 2404 wrote to memory of 2452	2404	679a6c4fc295a2fabb6a48f01dec6c55.exe	28
PID 2404 wrote to memory of 2452	2404	679a6c4fc295a2fabb6a48f01dec6c55.exe	28

C:\Users\Admin\AppData\Local\Temp\679a6c4fc295a2fabb6a48f01dec6c55.exe
"C:\Users\Admin\AppData\Local\Temp\679a6c4fc295a2fabb6a48f01dec6c55.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 36
  2⤵
  - Program crash
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads