973a8e60513e206f520980bff85c3fdcb1d35b53a4ca708276abe81157772abf | Triage

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 13:46

Sharing

Report Analysis Logs

General

Target

9992fd640ee99a82c7bd2cf6bbfea323.exe
Size

25KB
MD5

9992fd640ee99a82c7bd2cf6bbfea323
SHA1

ea624da64d3089ad3b116babe7ca08f3516e99d2
SHA256

973a8e60513e206f520980bff85c3fdcb1d35b53a4ca708276abe81157772abf
SHA512

26383f5cc34e5d2275f71c189a3a27327196d3678db75de58f8cf986d0c1ab5012fb2d815a8bce100bfd881deee13b3b2081e7b703a0636ee84dcf9a016a57dc
SSDEEP

768:gHUzfsG66ShNbIO0dgXAkrTT9erh07T5P:2G668NbOaTrPc2N

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	2996	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2772	2996	9992fd640ee99a82c7bd2cf6bbfea323.exe	28
PID 2996 wrote to memory of 2772	2996	9992fd640ee99a82c7bd2cf6bbfea323.exe	28
PID 2996 wrote to memory of 2772	2996	9992fd640ee99a82c7bd2cf6bbfea323.exe	28
PID 2996 wrote to memory of 2772	2996	9992fd640ee99a82c7bd2cf6bbfea323.exe	28

C:\Users\Admin\AppData\Local\Temp\9992fd640ee99a82c7bd2cf6bbfea323.exe
"C:\Users\Admin\AppData\Local\Temp\9992fd640ee99a82c7bd2cf6bbfea323.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 44
  2⤵
  - Program crash
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-0-0x0000000013140000-0x00000000131C8000-memory.dmp

Filesize
544KB

Download
memory/2996-1-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/2996-2-0x0000000013140000-0x00000000131C8000-memory.dmp

Filesize
544KB

Download