5a3e7d8c2740df05249d0c64f7c6c15469005878d1a73574b06b591e9fb0b18a | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 07:07

Sharing

Report Analysis Logs

General

Target

98c8436e397ac961d4ce25910be92acf.exe
Size

131KB
MD5

98c8436e397ac961d4ce25910be92acf
SHA1

1982980df36af6aaedbce17beb5533356b07f73b
SHA256

5a3e7d8c2740df05249d0c64f7c6c15469005878d1a73574b06b591e9fb0b18a
SHA512

5b6dcea236e65c2786af01f9e9878f8e54ea98ae006deac87d9ee944a0967bb101a0228c5dabdcd772715039c3d389b0c1b91ca56f1460fed3af807b9c1d43b4
SSDEEP

3072:32O5jRXIvkVuYuQ+TMjOPB3qcxtDlkRu9:mOjRCgbu54Z8+Y9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2880	2928	98c8436e397ac961d4ce25910be92acf.exe	28
PID 2928 wrote to memory of 2880	2928	98c8436e397ac961d4ce25910be92acf.exe	28
PID 2928 wrote to memory of 2880	2928	98c8436e397ac961d4ce25910be92acf.exe	28
PID 2928 wrote to memory of 2880	2928	98c8436e397ac961d4ce25910be92acf.exe	28

C:\Users\Admin\AppData\Local\Temp\98c8436e397ac961d4ce25910be92acf.exe
"C:\Users\Admin\AppData\Local\Temp\98c8436e397ac961d4ce25910be92acf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 44
  2⤵
  - Program crash
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download