925d7d8c593eea153d6338be2d829f46f7ddec517b02369642dd5df3ba629318 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 19:19

Sharing

Report Analysis Logs

General

Target

a28cc17a3a1b2a6233f0cd25a7342626.exe
Size

39KB
MD5

a28cc17a3a1b2a6233f0cd25a7342626
SHA1

b1ab4bba6f3c3ffe399bdb3c2c33de23b6907535
SHA256

925d7d8c593eea153d6338be2d829f46f7ddec517b02369642dd5df3ba629318
SHA512

8b8398593c7897594484852813341ed86ecbada09b3ecf75d2bb30decd1d28c58454ac8499e5bdfa86979bf93045f1ae516d8e6068ea1c7de18c3d40172316b5
SSDEEP

768:yd6orTi7hkmeFIbtqADYdz2SGUuJ9wqtsJz91I6:TorTitkmQIsADYdzT4KJ3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2088	WerFault.exe	20

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2076	2088	a28cc17a3a1b2a6233f0cd25a7342626.exe	28
PID 2088 wrote to memory of 2076	2088	a28cc17a3a1b2a6233f0cd25a7342626.exe	28
PID 2088 wrote to memory of 2076	2088	a28cc17a3a1b2a6233f0cd25a7342626.exe	28
PID 2088 wrote to memory of 2076	2088	a28cc17a3a1b2a6233f0cd25a7342626.exe	28

C:\Users\Admin\AppData\Local\Temp\a28cc17a3a1b2a6233f0cd25a7342626.exe
"C:\Users\Admin\AppData\Local\Temp\a28cc17a3a1b2a6233f0cd25a7342626.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 132
  2⤵
  - Program crash
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-0-0x0000000001CF0000-0x0000000001D30000-memory.dmp

Filesize
256KB

Download
memory/2088-1-0x0000000001CF0000-0x0000000001D30000-memory.dmp

Filesize
256KB

Download
memory/2088-2-0x0000000001CF0000-0x0000000001D30000-memory.dmp

Filesize
256KB

Download
memory/2088-3-0x0000000001CF0000-0x0000000001D30000-memory.dmp

Filesize
256KB

Download