090cfd5a89b8e71303e0f6450716d391d783b6505f5e378f7a50a50db2792f3d | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 13:38

Sharing

Report Analysis Logs

General

Target

67c0d8558fb9efa8ef7989acaa789ddf.exe
Size

15KB
MD5

67c0d8558fb9efa8ef7989acaa789ddf
SHA1

edc280265fe1f673f13eceb5275ae2eb7aadc094
SHA256

090cfd5a89b8e71303e0f6450716d391d783b6505f5e378f7a50a50db2792f3d
SHA512

ccd3dae81be12691f9f8f535239cd3738c9dbbcc1f0ce9505831a2ddf824fdb0de564165182bb386935a43c3ddd800b390cba1b5d9d391fb9a7f5e61e5830cd9
SSDEEP

384:pD5xO5Pco9L2KMlXfMygoKQpbi5ftgsMilTQ2n:js5PcuyKSMHzYmVmKTQY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2532	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2540	2532	67c0d8558fb9efa8ef7989acaa789ddf.exe	28
PID 2532 wrote to memory of 2540	2532	67c0d8558fb9efa8ef7989acaa789ddf.exe	28
PID 2532 wrote to memory of 2540	2532	67c0d8558fb9efa8ef7989acaa789ddf.exe	28
PID 2532 wrote to memory of 2540	2532	67c0d8558fb9efa8ef7989acaa789ddf.exe	28

C:\Users\Admin\AppData\Local\Temp\67c0d8558fb9efa8ef7989acaa789ddf.exe
"C:\Users\Admin\AppData\Local\Temp\67c0d8558fb9efa8ef7989acaa789ddf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 36
  2⤵
  - Program crash
  PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download