7b227f4532f06bf9538688c8ccc3876a9fc85247bca8d4be68f5ced9ecab65f4 | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 02:49

Sharing

Report Analysis Logs

General

Target

8b341d9a211a8b364120753c43cbb21e.exe
Size

132KB
MD5

8b341d9a211a8b364120753c43cbb21e
SHA1

42230db32799b9960ada7a4decbdbc82b38cec00
SHA256

7b227f4532f06bf9538688c8ccc3876a9fc85247bca8d4be68f5ced9ecab65f4
SHA512

8f426db5cd4833500ae5f6fab064d6ece59695b1d037277531a2bccbf6c60f805131afe88206e1fd3a7643f99bb494d90e12518dd1d86f980f02b4096bc2463a
SSDEEP

3072:hX0K0n+Qu8sAh7xXMifo16c2RThLSl0XJT:eVn+QuIh7xOeBQl4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1984	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1708	1984	8b341d9a211a8b364120753c43cbb21e.exe	28
PID 1984 wrote to memory of 1708	1984	8b341d9a211a8b364120753c43cbb21e.exe	28
PID 1984 wrote to memory of 1708	1984	8b341d9a211a8b364120753c43cbb21e.exe	28
PID 1984 wrote to memory of 1708	1984	8b341d9a211a8b364120753c43cbb21e.exe	28

C:\Users\Admin\AppData\Local\Temp\8b341d9a211a8b364120753c43cbb21e.exe
"C:\Users\Admin\AppData\Local\Temp\8b341d9a211a8b364120753c43cbb21e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 36
  2⤵
  - Program crash
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download