2a410362d34cac068463ec0b22c82827c4d109409759a38e99d264d03c14a05b | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 02:26

Sharing

Report Analysis Logs

General

Target

85af79635c8a32720bd62a6fefbca874.exe
Size

8KB
MD5

85af79635c8a32720bd62a6fefbca874
SHA1

275341936d08f1f3f5f387c06496d6657b7b4f23
SHA256

2a410362d34cac068463ec0b22c82827c4d109409759a38e99d264d03c14a05b
SHA512

eab58861df0d2867ef2dda9d79ddf4de748ef8b09d33ee98ab971a8ee62359d26be531ba55b194aa3b277a1b5ac47132595b339c39dd1e2ce3236dfca017d985
SSDEEP

192:aHIa6/X/0/746wiVHewO5fLZPsrxfqgv8DHdto2:8IaRwiUwOtLSrxfqg2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	2140	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2040	2140	85af79635c8a32720bd62a6fefbca874.exe	28
PID 2140 wrote to memory of 2040	2140	85af79635c8a32720bd62a6fefbca874.exe	28
PID 2140 wrote to memory of 2040	2140	85af79635c8a32720bd62a6fefbca874.exe	28
PID 2140 wrote to memory of 2040	2140	85af79635c8a32720bd62a6fefbca874.exe	28

C:\Users\Admin\AppData\Local\Temp\85af79635c8a32720bd62a6fefbca874.exe
"C:\Users\Admin\AppData\Local\Temp\85af79635c8a32720bd62a6fefbca874.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 104
  2⤵
  - Program crash
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads