3b9d8235eca44fd1f2de3f82d35a0f3b671b5583da30696d27e8b1ceeaedbeef | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 20:59

Sharing

Report Analysis Logs

General

Target

7581b29fed89d14f249572db79e68079.exe
Size

102KB
MD5

7581b29fed89d14f249572db79e68079
SHA1

3c43e16dbf5807a34053a1c1876306540dbb9b7e
SHA256

3b9d8235eca44fd1f2de3f82d35a0f3b671b5583da30696d27e8b1ceeaedbeef
SHA512

ec46610931eba264b14f85c5d8bd202c33b557ab8643a969832a0a44d784f22ea1f9392a8358ef3904c9fa0f137c39182b38d15da08250bad336c4fd07a83222
SSDEEP

3072:DIFgwMAy6VBWyE3KjwxkpcqEnDneuBs21nIWl:817WrwwxkpcqEDneuBs2lf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2240	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2972	2240	7581b29fed89d14f249572db79e68079.exe	28
PID 2240 wrote to memory of 2972	2240	7581b29fed89d14f249572db79e68079.exe	28
PID 2240 wrote to memory of 2972	2240	7581b29fed89d14f249572db79e68079.exe	28
PID 2240 wrote to memory of 2972	2240	7581b29fed89d14f249572db79e68079.exe	28

C:\Users\Admin\AppData\Local\Temp\7581b29fed89d14f249572db79e68079.exe
"C:\Users\Admin\AppData\Local\Temp\7581b29fed89d14f249572db79e68079.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 44
  2⤵
  - Program crash
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2240-1-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download