4228efb9f3f89e85fd434405875991e42f165f985d25982559d9f06fc65412b3 | Triage

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 04:24

Sharing

Report Analysis Logs

General

Target

7170d6511dc07aa8b9dd54d13327e7e0.exe
Size

143KB
MD5

7170d6511dc07aa8b9dd54d13327e7e0
SHA1

1a43e9a3d79c98f2788095fdf902a0870b3b1cfa
SHA256

4228efb9f3f89e85fd434405875991e42f165f985d25982559d9f06fc65412b3
SHA512

4cc979b38ddc7328fe6b0f5047fc6139acff36ca3712854962b449c811c512ac55537eb1d3b45c6f36d8727f04936300442b6c1b9815f15ab05eac5e89929778
SSDEEP

3072:EIb/XK6fzVPMTCyZPbjFYMmfvtq+FY3mbClC3NMT:EEy6rSCyZPbjFYMwE1uG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	2512	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2136	2512	7170d6511dc07aa8b9dd54d13327e7e0.exe	28
PID 2512 wrote to memory of 2136	2512	7170d6511dc07aa8b9dd54d13327e7e0.exe	28
PID 2512 wrote to memory of 2136	2512	7170d6511dc07aa8b9dd54d13327e7e0.exe	28
PID 2512 wrote to memory of 2136	2512	7170d6511dc07aa8b9dd54d13327e7e0.exe	28

C:\Users\Admin\AppData\Local\Temp\7170d6511dc07aa8b9dd54d13327e7e0.exe
"C:\Users\Admin\AppData\Local\Temp\7170d6511dc07aa8b9dd54d13327e7e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 88
  2⤵
  - Program crash
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2512-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download