db73c09915436c502a4606a64069bca90c7ed293c45c94990ed0ee1b1bde5cdf | Triage

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:32

Sharing

Report Analysis Logs

General

Target

751a9c126ce0eae29f5892c6a6a7e17b.exe
Size

317KB
MD5

751a9c126ce0eae29f5892c6a6a7e17b
SHA1

b5cb5ff516228e956f2d04616242528ba9b17faa
SHA256

db73c09915436c502a4606a64069bca90c7ed293c45c94990ed0ee1b1bde5cdf
SHA512

1aa5851c46652a8b36c75b5f877cf6498d5b67f92506029acb4b0d9cee170e5a2d48e5304459e1c98693ce38361d20ed0d18f86e7a93c714e05c344ec15fa35a
SSDEEP

6144:4moeWIEK/hSdSu2OwfW91O5fW98sDr3rK:X7IS+ZP8sDru

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2996 2448 WerFault.exe 751a9c126ce0eae29f5892c6a6a7e17b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

751a9c126ce0eae29f5892c6a6a7e17b.exe

description	pid	process	target process
PID 2448 wrote to memory of 2996	2448	751a9c126ce0eae29f5892c6a6a7e17b.exe	WerFault.exe
PID 2448 wrote to memory of 2996	2448	751a9c126ce0eae29f5892c6a6a7e17b.exe	WerFault.exe
PID 2448 wrote to memory of 2996	2448	751a9c126ce0eae29f5892c6a6a7e17b.exe	WerFault.exe
PID 2448 wrote to memory of 2996	2448	751a9c126ce0eae29f5892c6a6a7e17b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\751a9c126ce0eae29f5892c6a6a7e17b.exe
"C:\Users\Admin\AppData\Local\Temp\751a9c126ce0eae29f5892c6a6a7e17b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 196
2⤵
- Program crash
PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2448-1-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download