bbc976b6d5ca6774130b05a62a6a8bd6a130b4c1362af805be75e2672a2a98a8 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 13:05

Sharing

Report Analysis Logs

General

Target

7a548eb190963c6593a8c3dd60f95b93.exe
Size

399KB
MD5

7a548eb190963c6593a8c3dd60f95b93
SHA1

e0764da951b20795f1f056a8731c4c2115091438
SHA256

bbc976b6d5ca6774130b05a62a6a8bd6a130b4c1362af805be75e2672a2a98a8
SHA512

9c4806ef1a4b526e66e587469907335bea1e0140fdcfcd01e0f055e8d2fdad885c8ec681cdae9a827b32b17e42d83c24efa419718ad69bd7a53f11bbb0299cea
SSDEEP

12288:lhKt7ElgJFlxaGbJQ4WbLmGujpQnZ3FJ8ZG2Fsu:DK9ElgJFvWbKG6pQn3u

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	3020	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2072	3020	7a548eb190963c6593a8c3dd60f95b93.exe	28
PID 3020 wrote to memory of 2072	3020	7a548eb190963c6593a8c3dd60f95b93.exe	28
PID 3020 wrote to memory of 2072	3020	7a548eb190963c6593a8c3dd60f95b93.exe	28
PID 3020 wrote to memory of 2072	3020	7a548eb190963c6593a8c3dd60f95b93.exe	28

C:\Users\Admin\AppData\Local\Temp\7a548eb190963c6593a8c3dd60f95b93.exe
"C:\Users\Admin\AppData\Local\Temp\7a548eb190963c6593a8c3dd60f95b93.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 36
  2⤵
  - Program crash
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3020-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download