406b115e6b27ae281dd98df71fed352603c30cd98cb1345b86313187c44bc051 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 18:25

Sharing

Report Analysis Logs

General

Target

75340ba844a832146d2178b0a118118f.exe
Size

36KB
MD5

75340ba844a832146d2178b0a118118f
SHA1

a88972338f6cae1ac0784a896eeaa693b80e51ae
SHA256

406b115e6b27ae281dd98df71fed352603c30cd98cb1345b86313187c44bc051
SHA512

b454eb1feeeb9615b123d3295172cdce94bf56b9bb1340dc38efeb6cccb8d875e03970778addd59a6bde0caadc8372fb6d7912af02cc3d5b0ae08d9a0c6adf81
SSDEEP

768:YJCJE+CUabnY3ksLD0w+Tm1ePIrtw3rQFK:YYCUaE9KcK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
816	3032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 816	3032	75340ba844a832146d2178b0a118118f.exe	28
PID 3032 wrote to memory of 816	3032	75340ba844a832146d2178b0a118118f.exe	28
PID 3032 wrote to memory of 816	3032	75340ba844a832146d2178b0a118118f.exe	28
PID 3032 wrote to memory of 816	3032	75340ba844a832146d2178b0a118118f.exe	28

C:\Users\Admin\AppData\Local\Temp\75340ba844a832146d2178b0a118118f.exe
"C:\Users\Admin\AppData\Local\Temp\75340ba844a832146d2178b0a118118f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 148
  2⤵
  - Program crash
  PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-0-0x0000000000400000-0x0000000000408640-memory.dmp

Filesize
33KB

Download