1968019f141ec80b6dfd9c3311eda6593567da8fc8c443963f116538d4fc2e7c | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 03:50

Sharing

Report Analysis Logs

General

Target

7c11ae757aa7790ce8cca4db2e00bdbb.exe
Size

32KB
MD5

7c11ae757aa7790ce8cca4db2e00bdbb
SHA1

bbc29ddc2ac29f2b5642ee12e592bba6280e7669
SHA256

1968019f141ec80b6dfd9c3311eda6593567da8fc8c443963f116538d4fc2e7c
SHA512

ea63dc7d93fc8bef70bb7e9c438e4b940584668da8aea62e00737595bff43cdd9f5d6124fb8d4b81fcb05dc0559262c6afa7f989369bbe7e4597d124f8cb38d0
SSDEEP

768:daQA/RU+lTy0SIaThVsFTV89WMJqJpHlr3MrUp:gpHTyEaVVsFTV89GJVlroY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2548	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3020	2548	7c11ae757aa7790ce8cca4db2e00bdbb.exe	28
PID 2548 wrote to memory of 3020	2548	7c11ae757aa7790ce8cca4db2e00bdbb.exe	28
PID 2548 wrote to memory of 3020	2548	7c11ae757aa7790ce8cca4db2e00bdbb.exe	28
PID 2548 wrote to memory of 3020	2548	7c11ae757aa7790ce8cca4db2e00bdbb.exe	28

C:\Users\Admin\AppData\Local\Temp\7c11ae757aa7790ce8cca4db2e00bdbb.exe
"C:\Users\Admin\AppData\Local\Temp\7c11ae757aa7790ce8cca4db2e00bdbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 96
  2⤵
  - Program crash
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download