cf907323f4893e56447a67c119c18cb0b4cb1a90cdc86df5ff39f83f0fa73728 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 00:02

Sharing

Report Analysis Logs

General

Target

70e89c0076ccca008e24d7fb1db1e9f3.exe
Size

49KB
MD5

70e89c0076ccca008e24d7fb1db1e9f3
SHA1

883020089b449567b770a89686f500479ff84590
SHA256

cf907323f4893e56447a67c119c18cb0b4cb1a90cdc86df5ff39f83f0fa73728
SHA512

b6a28d81c5a4e4270a9115799943e670559a53040125006573aecafcc92cedbdf7645e777c5ea974a5f3b9f8675b4a3a1e978a4c438bdcc4fc24646a2d99aba3
SSDEEP

1536:vnEkah9FisULYtapaO4IWzLhhHRCRuT/IdYU:vEr1ULYWaOQL/H4QzU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	1936	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2196	1936	70e89c0076ccca008e24d7fb1db1e9f3.exe	28
PID 1936 wrote to memory of 2196	1936	70e89c0076ccca008e24d7fb1db1e9f3.exe	28
PID 1936 wrote to memory of 2196	1936	70e89c0076ccca008e24d7fb1db1e9f3.exe	28
PID 1936 wrote to memory of 2196	1936	70e89c0076ccca008e24d7fb1db1e9f3.exe	28

C:\Users\Admin\AppData\Local\Temp\70e89c0076ccca008e24d7fb1db1e9f3.exe
"C:\Users\Admin\AppData\Local\Temp\70e89c0076ccca008e24d7fb1db1e9f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 152
  2⤵
  - Program crash
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1936-1-0x00000000001B0000-0x00000000001B5000-memory.dmp

Filesize
20KB

Download
memory/1936-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download