91fa4b62605e6a2a51fc1f81673a39b1675fbbb31c03f207685fcd91997cdabd | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 02:34

Sharing

Report Analysis Logs

General

Target

9603cb2ab205990023196dda1af2231a.exe
Size

128KB
MD5

9603cb2ab205990023196dda1af2231a
SHA1

0b53ba7622678e958b6f848a8495ea320bc52afc
SHA256

91fa4b62605e6a2a51fc1f81673a39b1675fbbb31c03f207685fcd91997cdabd
SHA512

b8f69edbf28c9996d0442660d8a2c3b5ce86926285a6fc658fbef11467054fa4a0c0741873824ff21b18d80c36e81336501a9ba483e7bbba86797a5957d40e5c
SSDEEP

3072:FgH+GRpK171U+rU9sfL2Wv5IKGZEq4XKApE:F6pK15U+Y9a6PEb9E

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1720	1936	9603cb2ab205990023196dda1af2231a.exe	28
PID 1936 wrote to memory of 1720	1936	9603cb2ab205990023196dda1af2231a.exe	28
PID 1936 wrote to memory of 1720	1936	9603cb2ab205990023196dda1af2231a.exe	28
PID 1936 wrote to memory of 1720	1936	9603cb2ab205990023196dda1af2231a.exe	28

C:\Users\Admin\AppData\Local\Temp\9603cb2ab205990023196dda1af2231a.exe
"C:\Users\Admin\AppData\Local\Temp\9603cb2ab205990023196dda1af2231a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 36
  2⤵
  - Program crash
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download