dd50e115c3ee4d4513b501ddb9a97631c88a50367e7515fec92e2cef5359abbf | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

98a9d6b26e2427ff689b965d76f495e4.exe
Size

420KB
MD5

98a9d6b26e2427ff689b965d76f495e4
SHA1

c1f8c90956c64731e4a4fffafcc1492b6ebbe45c
SHA256

dd50e115c3ee4d4513b501ddb9a97631c88a50367e7515fec92e2cef5359abbf
SHA512

ae94b0302f600d67afbe5ac70a9e531b495625c851ee1fe5306352937449914740e1571809f6087e187a098678f6e08b1381750a67df0abe81f4ce28e1b5bd0a
SSDEEP

12288:bIlHFf83IfXYYFi//eIcI5/xDD7bN9hefe:bIlB8wF43p7jhefe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2880	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2752	2880	98a9d6b26e2427ff689b965d76f495e4.exe	28
PID 2880 wrote to memory of 2752	2880	98a9d6b26e2427ff689b965d76f495e4.exe	28
PID 2880 wrote to memory of 2752	2880	98a9d6b26e2427ff689b965d76f495e4.exe	28
PID 2880 wrote to memory of 2752	2880	98a9d6b26e2427ff689b965d76f495e4.exe	28

C:\Users\Admin\AppData\Local\Temp\98a9d6b26e2427ff689b965d76f495e4.exe
"C:\Users\Admin\AppData\Local\Temp\98a9d6b26e2427ff689b965d76f495e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 120
  2⤵
  - Program crash
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download