7b9b9c58d5848d59fb139c17a2f6e69b1423b81ae8f0b2c50bf97e637c134ab6 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

983962cadca4ff917a5228070d5bc83c.exe
Size

17KB
MD5

983962cadca4ff917a5228070d5bc83c
SHA1

96987e724a2230305aedccb0ca4c5c804af9ada5
SHA256

7b9b9c58d5848d59fb139c17a2f6e69b1423b81ae8f0b2c50bf97e637c134ab6
SHA512

0f25b30e4af9211b0486cb4cab409d4273ecdfe46b43f24fbbb871f5ff5abe0d8f595868fbface44dbb5e10718705e2ab2e66758aaedda4b3ecbb3415640f47f
SSDEEP

384:8hom9NI/Uh8BIf4i4a+ERV7dhPuqpJehDM3tVK4zxa/:hCNzt4anjTuDEVK4V

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2488	2888	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2488	2888	983962cadca4ff917a5228070d5bc83c.exe	28
PID 2888 wrote to memory of 2488	2888	983962cadca4ff917a5228070d5bc83c.exe	28
PID 2888 wrote to memory of 2488	2888	983962cadca4ff917a5228070d5bc83c.exe	28
PID 2888 wrote to memory of 2488	2888	983962cadca4ff917a5228070d5bc83c.exe	28

C:\Users\Admin\AppData\Local\Temp\983962cadca4ff917a5228070d5bc83c.exe
"C:\Users\Admin\AppData\Local\Temp\983962cadca4ff917a5228070d5bc83c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 144
  2⤵
  - Program crash
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download