c3c08b94e956165562366c14e6ace4a5fe4c66edb0e47628ad94883e02f719ce | Triage

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 19:12

Sharing

Report Analysis Logs

General

Target

hzejkkd.exe
Size

261KB
MD5

6433e88c2c73b93e935c74e650fee81d
SHA1

4293beea2045cf34746a003ebe779f2302a177f5
SHA256

f16e83d67d23cae50e5c0b8881ff8206e4e73b026229396615d0b8bd2caec7b0
SHA512

f3f1d02345034397ee5e7866ec9d3638f054e4395fe82cbf79bf10e0062ae70bce4d50ffeff018392f85b4799e3bd715780b670606a1decfbe34899805563db7
SSDEEP

6144:C4KYr8wAStrwb6E/HtFdbr0vv5R2AJXN5WeSmkMud50:C4Ltrwb6E/HtFdbr0vv5RByeaMud5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	2676	WerFault.exe	70

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2628	2676	hzejkkd.exe	87
PID 2676 wrote to memory of 2628	2676	hzejkkd.exe	87
PID 2676 wrote to memory of 2628	2676	hzejkkd.exe	87

C:\Users\Admin\AppData\Local\Temp\hzejkkd.exe
"C:\Users\Admin\AppData\Local\Temp\hzejkkd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\hzejkkd.exe
  "C:\Users\Admin\AppData\Local\Temp\hzejkkd.exe"
  2⤵
  PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 524
  2⤵
  - Program crash
  PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2676 -ip 2676
1⤵
PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download