080f7d3134f33eeb5054edfe706d67a375ba4f1f4049c5448165733795943787 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 14:49

Sharing

Report Analysis Logs

General

Target

6fb3f05ca2b1760e9624e9a94906eec1.exe
Size

105KB
MD5

6fb3f05ca2b1760e9624e9a94906eec1
SHA1

18fb68de58413672b70cb217a2e699d8336994cd
SHA256

080f7d3134f33eeb5054edfe706d67a375ba4f1f4049c5448165733795943787
SHA512

adeaa1a979c386cf310816a29e461609304eff0f4bb74ce298847d84c8c0ab6bf9756264204ea18d3e0b8ac465713f9e11e5733ed61d5500e26c156088eb369d
SSDEEP

3072:i/E32QEFZhgnTJzA5W/YlNzpIBSTnbwVts:aUdEFsTi5sC1IBSrbwVC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2824	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2912	2824	6fb3f05ca2b1760e9624e9a94906eec1.exe	16
PID 2824 wrote to memory of 2912	2824	6fb3f05ca2b1760e9624e9a94906eec1.exe	16
PID 2824 wrote to memory of 2912	2824	6fb3f05ca2b1760e9624e9a94906eec1.exe	16
PID 2824 wrote to memory of 2912	2824	6fb3f05ca2b1760e9624e9a94906eec1.exe	16

C:\Users\Admin\AppData\Local\Temp\6fb3f05ca2b1760e9624e9a94906eec1.exe
"C:\Users\Admin\AppData\Local\Temp\6fb3f05ca2b1760e9624e9a94906eec1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 36
  2⤵
  - Program crash
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download