4e77f95c832878dfbaa3e10b7a960baf1fdc3dba774ba1dcc1a02a2a1edfb317 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 17:51

Sharing

Report Analysis Logs

General

Target

a261c199e1c5c06f6360fc4a6472b8b4.exe
Size

25KB
MD5

a261c199e1c5c06f6360fc4a6472b8b4
SHA1

244d750ea98a9f251f128e022ad92ba31a0e1d48
SHA256

4e77f95c832878dfbaa3e10b7a960baf1fdc3dba774ba1dcc1a02a2a1edfb317
SHA512

4c25dc654502a57546afc5ba3dfb0c6d59062e30e76e53d1daf313f8590c11657e046899ac89bce9da49515feb795791f179eed49d4c653178bfeec8cdef87d9
SSDEEP

768:LAjN+1jxvBA85stOCcQMMPduks1Mjn7lwNCn4OIbG:U+1FvBqtiiduMTJw44OIS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	3028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 764	3028	a261c199e1c5c06f6360fc4a6472b8b4.exe	28
PID 3028 wrote to memory of 764	3028	a261c199e1c5c06f6360fc4a6472b8b4.exe	28
PID 3028 wrote to memory of 764	3028	a261c199e1c5c06f6360fc4a6472b8b4.exe	28
PID 3028 wrote to memory of 764	3028	a261c199e1c5c06f6360fc4a6472b8b4.exe	28

C:\Users\Admin\AppData\Local\Temp\a261c199e1c5c06f6360fc4a6472b8b4.exe
"C:\Users\Admin\AppData\Local\Temp\a261c199e1c5c06f6360fc4a6472b8b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 64
  2⤵
  - Program crash
  PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads