2ae9533ff1bc93e8f96977b6417c2ebd4b9207ab147074b8e4811c8ef42eedc1 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 02:49

Sharing

Report Analysis Logs

General

Target

9849c403062c7544227635b2603d9ded.exe
Size

290KB
MD5

9849c403062c7544227635b2603d9ded
SHA1

f5a0044f07e8258f37ec2531ce0c1b465e455f41
SHA256

2ae9533ff1bc93e8f96977b6417c2ebd4b9207ab147074b8e4811c8ef42eedc1
SHA512

027eed82db92f96f0480eaa19beade066e63148644617377f1b04e236b48a88913611017898b2139f91599ba9c97e9289a5249db5cca25f78d2478b76c5d6c48
SSDEEP

6144:sRqssDQn0m6Atbr9XEIJ+T8jDe8c+hPAzR:sR4U9dEI48jDeKhC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	2108	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1360	2108	9849c403062c7544227635b2603d9ded.exe	28
PID 2108 wrote to memory of 1360	2108	9849c403062c7544227635b2603d9ded.exe	28
PID 2108 wrote to memory of 1360	2108	9849c403062c7544227635b2603d9ded.exe	28
PID 2108 wrote to memory of 1360	2108	9849c403062c7544227635b2603d9ded.exe	28

C:\Users\Admin\AppData\Local\Temp\9849c403062c7544227635b2603d9ded.exe
"C:\Users\Admin\AppData\Local\Temp\9849c403062c7544227635b2603d9ded.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 136
  2⤵
  - Program crash
  PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads