e569d2e7000ee62706c583d051d6b9fd9fac395cd3f30c73469c1deac200df58 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 01:44

Sharing

Report Analysis Logs

General

Target

760e2ed9c88d67358191cf3b0e9eee52.exe
Size

119KB
MD5

760e2ed9c88d67358191cf3b0e9eee52
SHA1

d4b3c55d1011e8d6e7e54ffd5306d28ab68c82f4
SHA256

e569d2e7000ee62706c583d051d6b9fd9fac395cd3f30c73469c1deac200df58
SHA512

0e0c99a3623b259500d932fdd932f492559134afdfde3379dfa2d66a6fd113fbe9bd5dbd218cddef586052b841f4c23f54c3ad4540cd098c4499c810f1cb4515
SSDEEP

3072:Pl8wOo63/9KMNvelJLFi08v3SvYQfjGWAIb:1SP9A7VwQfjGWAIb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1052	2032	760e2ed9c88d67358191cf3b0e9eee52.exe	29
PID 2032 wrote to memory of 1052	2032	760e2ed9c88d67358191cf3b0e9eee52.exe	29
PID 2032 wrote to memory of 1052	2032	760e2ed9c88d67358191cf3b0e9eee52.exe	29
PID 2032 wrote to memory of 1052	2032	760e2ed9c88d67358191cf3b0e9eee52.exe	29

C:\Users\Admin\AppData\Local\Temp\760e2ed9c88d67358191cf3b0e9eee52.exe
"C:\Users\Admin\AppData\Local\Temp\760e2ed9c88d67358191cf3b0e9eee52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 128
  2⤵
  - Program crash
  PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download