c0316592267b14ece7ecd856f73d280200814e5b349de0516229b8eb0af2671c | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 05:20

Sharing

Report Analysis Logs

General

Target

98939d50cbc830ba60aedcd9ad66b7c4.exe
Size

56KB
MD5

98939d50cbc830ba60aedcd9ad66b7c4
SHA1

03c95cd02c212f06ffdcb0cc39f5ab006bb69540
SHA256

c0316592267b14ece7ecd856f73d280200814e5b349de0516229b8eb0af2671c
SHA512

6d9cacfb4b67cb4b5b80912d985a79f968453d8e93dda9b4b94b06b7864bd8bab3a298ed49f62774b7b9fa44b556af252ccb9ee34ba06e8692d18e9a43f461a5
SSDEEP

1536:1fUSMX+Ocm8FkNdRmM9+0yyOQ46r4vbm7EYv9FEa:1LMOxXFkNt+VbxG9FP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	1760	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2040	1760	98939d50cbc830ba60aedcd9ad66b7c4.exe	17
PID 1760 wrote to memory of 2040	1760	98939d50cbc830ba60aedcd9ad66b7c4.exe	17
PID 1760 wrote to memory of 2040	1760	98939d50cbc830ba60aedcd9ad66b7c4.exe	17
PID 1760 wrote to memory of 2040	1760	98939d50cbc830ba60aedcd9ad66b7c4.exe	17

C:\Users\Admin\AppData\Local\Temp\98939d50cbc830ba60aedcd9ad66b7c4.exe
"C:\Users\Admin\AppData\Local\Temp\98939d50cbc830ba60aedcd9ad66b7c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 36
  2⤵
  - Program crash
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download