56fd17625a00e44b59b623ac0c5297de4db53fe8e668df6b98b296bfd43b47df | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 02:13

Sharing

Report Analysis Logs

General

Target

9a7e0fc06774bffd859ab0f8291bba68.exe
Size

69KB
MD5

9a7e0fc06774bffd859ab0f8291bba68
SHA1

b350852db92ab02490d25c520b0f3fd59aab3dd3
SHA256

56fd17625a00e44b59b623ac0c5297de4db53fe8e668df6b98b296bfd43b47df
SHA512

eb74f390876359f884bba619e822e92ef93f04b9b45d82c991c1e496c02b0a7209376ad9faadeea6ab78be7d59a340d834a71dee1238f0467a631fc88b0bb69b
SSDEEP

1536:dCxm+5Tf9uDNSQ85GdSu6hBOCBB78cH92dIwmlfF:r+ZfYBMGdSuap7Hd2awY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1872	2296	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1872	2296	9a7e0fc06774bffd859ab0f8291bba68.exe	28
PID 2296 wrote to memory of 1872	2296	9a7e0fc06774bffd859ab0f8291bba68.exe	28
PID 2296 wrote to memory of 1872	2296	9a7e0fc06774bffd859ab0f8291bba68.exe	28
PID 2296 wrote to memory of 1872	2296	9a7e0fc06774bffd859ab0f8291bba68.exe	28

C:\Users\Admin\AppData\Local\Temp\9a7e0fc06774bffd859ab0f8291bba68.exe
"C:\Users\Admin\AppData\Local\Temp\9a7e0fc06774bffd859ab0f8291bba68.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 88
  2⤵
  - Program crash
  PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download