6598ecc83276a1ac6c1f0689453406dfba3c89435884c20bc55c66b80a1fb1d3 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 14:58

Sharing

Report Analysis Logs

General

Target

872cda7eaf0524c09281aaee5535a9e0.exe
Size

32KB
MD5

872cda7eaf0524c09281aaee5535a9e0
SHA1

184efc22aec254ef6f27fe53eec5b2a736a83b1f
SHA256

6598ecc83276a1ac6c1f0689453406dfba3c89435884c20bc55c66b80a1fb1d3
SHA512

066dcae27a28e36687a803bfbb1200d49368b0a1210db6d11b54164c5d4a8080c9385da1a52b40875778674e408c1b7fe5c0b0d222e6445933d236f4fab31e8c
SSDEEP

768:GclAKPUpUmznNlqdklhOOSNU98u0aft6Yg:GVpHNwdklhOhUb0Gt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	748	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2100	748	872cda7eaf0524c09281aaee5535a9e0.exe	28
PID 748 wrote to memory of 2100	748	872cda7eaf0524c09281aaee5535a9e0.exe	28
PID 748 wrote to memory of 2100	748	872cda7eaf0524c09281aaee5535a9e0.exe	28
PID 748 wrote to memory of 2100	748	872cda7eaf0524c09281aaee5535a9e0.exe	28

C:\Users\Admin\AppData\Local\Temp\872cda7eaf0524c09281aaee5535a9e0.exe
"C:\Users\Admin\AppData\Local\Temp\872cda7eaf0524c09281aaee5535a9e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 88
  2⤵
  - Program crash
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download