b6e063e84d82fe3bfaf9e31356d1a88965a69b6d10e94c221bd19bce1776747c | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 08:06

Sharing

Report Analysis Logs

General

Target

79b678e3d48ab5a16ba4e0131febbaff.exe
Size

101KB
MD5

79b678e3d48ab5a16ba4e0131febbaff
SHA1

506f092306ca281cb4726ab75fbc07c224f0e332
SHA256

b6e063e84d82fe3bfaf9e31356d1a88965a69b6d10e94c221bd19bce1776747c
SHA512

c59a248f29e18e63e3489b727df8de1049801942d92101071cb687ca7cdbf86aabc1e616c1e08f9f42d610b5444cd9e34648d6b730b740b3a9b496102741d8e4
SSDEEP

3072:PvWO8I7c2MyMS4ExXv8Nuo5G6MFhjtpu:P+deGExmuo5rM/z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2648	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2752	2648	79b678e3d48ab5a16ba4e0131febbaff.exe	28
PID 2648 wrote to memory of 2752	2648	79b678e3d48ab5a16ba4e0131febbaff.exe	28
PID 2648 wrote to memory of 2752	2648	79b678e3d48ab5a16ba4e0131febbaff.exe	28
PID 2648 wrote to memory of 2752	2648	79b678e3d48ab5a16ba4e0131febbaff.exe	28

C:\Users\Admin\AppData\Local\Temp\79b678e3d48ab5a16ba4e0131febbaff.exe
"C:\Users\Admin\AppData\Local\Temp\79b678e3d48ab5a16ba4e0131febbaff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 44
  2⤵
  - Program crash
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads