791ce874535974d5a8409ba64cd41408a2ab3a02594696a716a807606ed5963d | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 02:43

Sharing

Report Analysis Logs

General

Target

8b30f2ad28c8348159eee263a1920851.exe
Size

68KB
MD5

8b30f2ad28c8348159eee263a1920851
SHA1

a33787ea9dff953a16013a18a513ef18e9b8a58d
SHA256

791ce874535974d5a8409ba64cd41408a2ab3a02594696a716a807606ed5963d
SHA512

db8e98fb7d89095d09de47f0e996e56ceefc15f2fe009f6aed545c6e9b26a65441aeb3d0ad261a5d73c033a891da6fef2c10a0f8e67b156f64fbaff9461c7015
SSDEEP

1536:rB1uogW/LAqPhF7H7ZwAscRc2Ektd2W5lehld:VEogW/BzLaADq2Bt4WH6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	2124	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2432	2124	8b30f2ad28c8348159eee263a1920851.exe	28
PID 2124 wrote to memory of 2432	2124	8b30f2ad28c8348159eee263a1920851.exe	28
PID 2124 wrote to memory of 2432	2124	8b30f2ad28c8348159eee263a1920851.exe	28
PID 2124 wrote to memory of 2432	2124	8b30f2ad28c8348159eee263a1920851.exe	28

C:\Users\Admin\AppData\Local\Temp\8b30f2ad28c8348159eee263a1920851.exe
"C:\Users\Admin\AppData\Local\Temp\8b30f2ad28c8348159eee263a1920851.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 88
  2⤵
  - Program crash
  PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2124-1-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download