126a7c663e582d776c148d8ab39ac3c6f0a9bb349e0916d4d016cd4c4bfedea0 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9968a6e94e0d1b8eb16450f2b8ec6e86.exe
Size

131KB
MD5

9968a6e94e0d1b8eb16450f2b8ec6e86
SHA1

63f1ecc5cd6936b39690762d662f6f55d8282e25
SHA256

126a7c663e582d776c148d8ab39ac3c6f0a9bb349e0916d4d016cd4c4bfedea0
SHA512

e6405de263bba013b5d48af913e66cf72113828dd63deaaa11234b8146b63c49299ff3d58c7c5a2976853ffe8698ddfb6d6c04ecfdbd0d647463f270ec9cb2c9
SSDEEP

3072:okVD1BSqao9c3HwsanTdgyOxsP+f+sBx7pp48csGQE:dSqjc3HsTaxoqz6BsFE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2940	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2816	2940	9968a6e94e0d1b8eb16450f2b8ec6e86.exe	28
PID 2940 wrote to memory of 2816	2940	9968a6e94e0d1b8eb16450f2b8ec6e86.exe	28
PID 2940 wrote to memory of 2816	2940	9968a6e94e0d1b8eb16450f2b8ec6e86.exe	28
PID 2940 wrote to memory of 2816	2940	9968a6e94e0d1b8eb16450f2b8ec6e86.exe	28

C:\Users\Admin\AppData\Local\Temp\9968a6e94e0d1b8eb16450f2b8ec6e86.exe
"C:\Users\Admin\AppData\Local\Temp\9968a6e94e0d1b8eb16450f2b8ec6e86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 100
  2⤵
  - Program crash
  PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download