473720d6260a0b3a5bf8ec64e9bc224c5d8a5be6f045515e5d4fe3d0c63b2a57 | Triage

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 16:46

Sharing

Report Analysis Logs

General

Target

8cd5bab65bcd5a51f19b64216c2a8e55.exe
Size

55KB
MD5

8cd5bab65bcd5a51f19b64216c2a8e55
SHA1

bcc8a2fd41e76d367f233327d79914a448972d1e
SHA256

473720d6260a0b3a5bf8ec64e9bc224c5d8a5be6f045515e5d4fe3d0c63b2a57
SHA512

2278ef11ad96fe7cbf5ac82102175b9cb6f92603f1f189062802fc2624832df1bebb40e9d2324ca478ea657a7c7ffca5fad6ab90412c66cde6dc78c6f2895c23
SSDEEP

1536:URKy2z/NaXv+vJhsZNjN+oZid9PTsJRUnr:9ySwX2vJhkNjNjsd9ww

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	2184	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2296	2184	8cd5bab65bcd5a51f19b64216c2a8e55.exe	28
PID 2184 wrote to memory of 2296	2184	8cd5bab65bcd5a51f19b64216c2a8e55.exe	28
PID 2184 wrote to memory of 2296	2184	8cd5bab65bcd5a51f19b64216c2a8e55.exe	28
PID 2184 wrote to memory of 2296	2184	8cd5bab65bcd5a51f19b64216c2a8e55.exe	28

C:\Users\Admin\AppData\Local\Temp\8cd5bab65bcd5a51f19b64216c2a8e55.exe
"C:\Users\Admin\AppData\Local\Temp\8cd5bab65bcd5a51f19b64216c2a8e55.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 36
  2⤵
  - Program crash
  PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2184-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download