79e79b2325a13723a114915274b0135c1ff6443a3ee39a2067ca45358532f22b | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

802cc4f10309e7f375b3b3030e137337.exe
Size

132KB
MD5

802cc4f10309e7f375b3b3030e137337
SHA1

8fbecc57609f6d5a830fe011e0cc4f96accbd252
SHA256

79e79b2325a13723a114915274b0135c1ff6443a3ee39a2067ca45358532f22b
SHA512

5cd8b3d1e573f65aded11fbbf9ea61a0840859cb85ccd16af4212d29961d2e69d223b10b0357f71dc99b795a253ce27a3eb5bdeb788ea6ceb2f5b6328330a8bd
SSDEEP

3072:6hh0HPtgj7JTM+RQBMakyal9VbUx/pHdBeS0RQer:6LIuaOQBMakymjYx3n

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1708	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1948	1708	802cc4f10309e7f375b3b3030e137337.exe	28
PID 1708 wrote to memory of 1948	1708	802cc4f10309e7f375b3b3030e137337.exe	28
PID 1708 wrote to memory of 1948	1708	802cc4f10309e7f375b3b3030e137337.exe	28
PID 1708 wrote to memory of 1948	1708	802cc4f10309e7f375b3b3030e137337.exe	28

C:\Users\Admin\AppData\Local\Temp\802cc4f10309e7f375b3b3030e137337.exe
"C:\Users\Admin\AppData\Local\Temp\802cc4f10309e7f375b3b3030e137337.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 36
  2⤵
  - Program crash
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download