272807fcae1a775457d677705429c65471192b5b55423ba90937272d35aadb58 | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 23:47

Sharing

Report Analysis Logs

General

Target

a0a8ac4730ab62d610a37b31ce0a7738.exe
Size

16KB
MD5

a0a8ac4730ab62d610a37b31ce0a7738
SHA1

f1ee99ea26cedec2933a44402d43af1a08905f7f
SHA256

272807fcae1a775457d677705429c65471192b5b55423ba90937272d35aadb58
SHA512

cb47b33149691643e007d234a3106beffa3f1afb1fbf608b6d38611a7361fb286aa20e0ff66da801aaca4b40ab72be0821d35908b8501c9a2b836f38d235d633
SSDEEP

384:wX591GxGGZHAq49tkeJPHpk7BMiyK+J+2x+Qi3iyy:ozwGGx3okeJfpQvds+2AD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	2416	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2732	2416	a0a8ac4730ab62d610a37b31ce0a7738.exe	28
PID 2416 wrote to memory of 2732	2416	a0a8ac4730ab62d610a37b31ce0a7738.exe	28
PID 2416 wrote to memory of 2732	2416	a0a8ac4730ab62d610a37b31ce0a7738.exe	28
PID 2416 wrote to memory of 2732	2416	a0a8ac4730ab62d610a37b31ce0a7738.exe	28

C:\Users\Admin\AppData\Local\Temp\a0a8ac4730ab62d610a37b31ce0a7738.exe
"C:\Users\Admin\AppData\Local\Temp\a0a8ac4730ab62d610a37b31ce0a7738.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 88
  2⤵
  - Program crash
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x0000000000400000-0x0000000000410200-memory.dmp

Filesize
64KB

Download
memory/2416-1-0x0000000000400000-0x0000000000410200-memory.dmp

Filesize
64KB

Download