Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74eb66f46d5475544ac259b4fcb9636f.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
General
-
Target
74eb66f46d5475544ac259b4fcb9636f.exe
-
Size
73KB
-
MD5
74eb66f46d5475544ac259b4fcb9636f
-
SHA1
c20d316950f8494f1352ec9e058c349b1787e27b
-
SHA256
e6635263dbae6e9696aafe0ba57c55803e33ce3c32487cbd688d078c6d6b332c
-
SHA512
298decd19d3080c5ca82ae0220aaeec8f4758959dbafe3ae7cc34bc4c729c258d2837b559cb81dbf642a2bd15b12b5acdead77300fad93945ae1a78d887934d3
-
SSDEEP
1536:qCxKOBJyypgmDzV2NSQ85GdSu6uhkkUoUvGJdk5bH:1nyypmMGdSulaoUO6H
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2280 2120 WerFault.exe 74eb66f46d5475544ac259b4fcb9636f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
74eb66f46d5475544ac259b4fcb9636f.exedescription pid process target process PID 2120 wrote to memory of 2280 2120 74eb66f46d5475544ac259b4fcb9636f.exe WerFault.exe PID 2120 wrote to memory of 2280 2120 74eb66f46d5475544ac259b4fcb9636f.exe WerFault.exe PID 2120 wrote to memory of 2280 2120 74eb66f46d5475544ac259b4fcb9636f.exe WerFault.exe PID 2120 wrote to memory of 2280 2120 74eb66f46d5475544ac259b4fcb9636f.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74eb66f46d5475544ac259b4fcb9636f.exe"C:\Users\Admin\AppData\Local\Temp\74eb66f46d5475544ac259b4fcb9636f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 882⤵
- Program crash
PID:2280
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2120-0-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB