ac9f473f0f3ce2e3e38d68e2ae56149d121e74fcdbf8672cf1520f16521135e0 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 19:46

Sharing

Report Analysis Logs

General

Target

file.exe
Size

508KB
MD5

2f0f1de54fa34d9467d01cc2da73c385
SHA1

9a736560470472f49de3dd9b48860bad1dc046d3
SHA256

ac9f473f0f3ce2e3e38d68e2ae56149d121e74fcdbf8672cf1520f16521135e0
SHA512

6be03773032827804b3512d8823f0386887b20af73a2f4e7becd77926c6abb5f15e96b19509d8f104fba136c1b7ea76a2b46e5fa56e84f03b0b847f6862734e2
SSDEEP

12288:8tjWq6P+CQxsJZLfFftzatlNd3WyHznPu:8tKNWpxsD9leFdmt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
536	1724	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 536	1724	file.exe	28
PID 1724 wrote to memory of 536	1724	file.exe	28
PID 1724 wrote to memory of 536	1724	file.exe	28
PID 1724 wrote to memory of 536	1724	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 92
  2⤵
  - Program crash
  PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download