e0d14c93a02c672c23a965926854729f20ce324722362fb8938f228c42203b17 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 02:03

Sharing

Report Analysis Logs

General

Target

7e978a0b60b76818dd778a35bcf344a4.exe
Size

166KB
MD5

7e978a0b60b76818dd778a35bcf344a4
SHA1

d0bee1e988597175185964792a9bd9287d41241e
SHA256

e0d14c93a02c672c23a965926854729f20ce324722362fb8938f228c42203b17
SHA512

373266bb6aca8a941910f325e6d5b3c651f8388eba88680924408b819375eda86d7c71dd5bf507b8eb927017f5e2b0a4642aa00af6a3c52ea3e08b1629fa4efb
SSDEEP

3072:XBcQBpm448ygPCCTGS/JJl+jbezJdJNRhvPc2F4N8:XBrBp34SPRF8bAJTFP5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	2956	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 944	2956	7e978a0b60b76818dd778a35bcf344a4.exe	28
PID 2956 wrote to memory of 944	2956	7e978a0b60b76818dd778a35bcf344a4.exe	28
PID 2956 wrote to memory of 944	2956	7e978a0b60b76818dd778a35bcf344a4.exe	28
PID 2956 wrote to memory of 944	2956	7e978a0b60b76818dd778a35bcf344a4.exe	28

C:\Users\Admin\AppData\Local\Temp\7e978a0b60b76818dd778a35bcf344a4.exe
"C:\Users\Admin\AppData\Local\Temp\7e978a0b60b76818dd778a35bcf344a4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 84
  2⤵
  - Program crash
  PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads