d9f8c867c5613e7f6bed39a46b9829b430b84e8062f50d2d11d6f848f766e2fa | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 15:26

Sharing

Report Analysis Logs

General

Target

6fc86099eab53f3fa327d65f6919f017.exe
Size

16KB
MD5

6fc86099eab53f3fa327d65f6919f017
SHA1

f7148df8b199898d2d8748812a1637daaa0992db
SHA256

d9f8c867c5613e7f6bed39a46b9829b430b84e8062f50d2d11d6f848f766e2fa
SHA512

ae2ba354a53f7c027ef0fde462aefb40b68b344f1c9d58d0c0b8dfce8e0fc52b538d57a4a03d98bef21170b5406b31d364d6426e0096fbf47189f70e4e1967a3
SSDEEP

48:aN3U9I5mNEmxwR0u3TSNG2nn3nncm0VAFP4oyl1p/:VEmNc0ujSI20VQP4oynJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2532	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2664	2532	6fc86099eab53f3fa327d65f6919f017.exe	29
PID 2532 wrote to memory of 2664	2532	6fc86099eab53f3fa327d65f6919f017.exe	29
PID 2532 wrote to memory of 2664	2532	6fc86099eab53f3fa327d65f6919f017.exe	29
PID 2532 wrote to memory of 2664	2532	6fc86099eab53f3fa327d65f6919f017.exe	29

C:\Users\Admin\AppData\Local\Temp\6fc86099eab53f3fa327d65f6919f017.exe
"C:\Users\Admin\AppData\Local\Temp\6fc86099eab53f3fa327d65f6919f017.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 148
  2⤵
  - Program crash
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads