b4bdbb4863bfcf342af29dfc854d3fe636edb01f2291410fc1861a7e83aac045 | Triage

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7f4e3f9b16782cf7523dd39725f17db0.exe
Size

40KB
MD5

7f4e3f9b16782cf7523dd39725f17db0
SHA1

0bafdee74a199920bf161808251fb6654759d454
SHA256

b4bdbb4863bfcf342af29dfc854d3fe636edb01f2291410fc1861a7e83aac045
SHA512

8a25da4abe28c29eaeb28ef8f0371b2b661319289b18357c3fef1e346eae3afb9b2c3b92489d2d25362e86017ca23e9caa769bebe53c4b8ec9fb48390be36ec5
SSDEEP

768:v87gLESwE42I5mCQ0Y910QEH5b1ScyLlCPW5v:BLE1EoXRo10Q8cl6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1816	2064	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1816	2064	7f4e3f9b16782cf7523dd39725f17db0.exe	28
PID 2064 wrote to memory of 1816	2064	7f4e3f9b16782cf7523dd39725f17db0.exe	28
PID 2064 wrote to memory of 1816	2064	7f4e3f9b16782cf7523dd39725f17db0.exe	28
PID 2064 wrote to memory of 1816	2064	7f4e3f9b16782cf7523dd39725f17db0.exe	28

C:\Users\Admin\AppData\Local\Temp\7f4e3f9b16782cf7523dd39725f17db0.exe
"C:\Users\Admin\AppData\Local\Temp\7f4e3f9b16782cf7523dd39725f17db0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 88
  2⤵
  - Program crash
  PID:1816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-0-0x0000000013140000-0x000000001314F000-memory.dmp

Filesize
60KB

Download
memory/2064-1-0x0000000013140000-0x000000001314F000-memory.dmp

Filesize
60KB

Download
memory/2064-2-0x0000000000160000-0x0000000000169000-memory.dmp

Filesize
36KB

Download
memory/2064-3-0x0000000013140000-0x000000001314F000-memory.dmp

Filesize
60KB

Download