911276c68ec3c4b29cbb6de06ab1738d5c39c0272b747553adae84afb0d3a7bb | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 12:43

Sharing

Report Analysis Logs

General

Target

7zdir.exe
Size

5KB
MD5

573157e85395eb110a086a199b594132
SHA1

92cd757b5c8b03a3b78af2b50e5b0a68702f8f72
SHA256

911276c68ec3c4b29cbb6de06ab1738d5c39c0272b747553adae84afb0d3a7bb
SHA512

c68d49c5a924082ffd2fe6260255d8eabff0384c38056e6b09b0804425cc37eb283a9f0d4ab498eff6fe4eb013045109434d70509a38b6223cd789f7308dc65e
SSDEEP

96:9PXW09WXl0WdrXUVZDfuurn7e+WUdSAzNt:9vW2WXSCAjzuuHQC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	1904	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2136	1904	7zdir.exe	29
PID 1904 wrote to memory of 2136	1904	7zdir.exe	29
PID 1904 wrote to memory of 2136	1904	7zdir.exe	29
PID 1904 wrote to memory of 2136	1904	7zdir.exe	29

C:\Users\Admin\AppData\Local\Temp\7zdir.exe
"C:\Users\Admin\AppData\Local\Temp\7zdir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 568
  2⤵
  - Program crash
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-0-0x0000000000D60000-0x0000000000D68000-memory.dmp

Filesize
32KB

Download
memory/1904-1-0x0000000074D50000-0x000000007543E000-memory.dmp

Filesize
6.9MB

Download
memory/1904-2-0x0000000074D50000-0x000000007543E000-memory.dmp

Filesize
6.9MB

Download