a8a12e501c5cd68326f4929845f956668c951d440fbd9af021af8a0230f40cc8 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 20:03

Sharing

Report Analysis Logs

General

Target

a2a192e3c83fb3453b6bb5399b9e6e5f.exe
Size

252KB
MD5

a2a192e3c83fb3453b6bb5399b9e6e5f
SHA1

30f7262a2129e07554b43ac2f66c9ba682e872d3
SHA256

a8a12e501c5cd68326f4929845f956668c951d440fbd9af021af8a0230f40cc8
SHA512

ffc08cfdabe409149a71ad2d47498b9a4f657bbad047d985357790890e047acd8d3162f616f78a571fc5f0883f5daf5712f9d1a8cbab9d5bbfc395131a35d30c
SSDEEP

6144:eiLYMqGgt6zIUrATsBhJxIDcfftmL2c8uEC:VYtCrAUIAdmL2jK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	3028	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 764	3028	a2a192e3c83fb3453b6bb5399b9e6e5f.exe	28
PID 3028 wrote to memory of 764	3028	a2a192e3c83fb3453b6bb5399b9e6e5f.exe	28
PID 3028 wrote to memory of 764	3028	a2a192e3c83fb3453b6bb5399b9e6e5f.exe	28
PID 3028 wrote to memory of 764	3028	a2a192e3c83fb3453b6bb5399b9e6e5f.exe	28

C:\Users\Admin\AppData\Local\Temp\a2a192e3c83fb3453b6bb5399b9e6e5f.exe
"C:\Users\Admin\AppData\Local\Temp\a2a192e3c83fb3453b6bb5399b9e6e5f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 92
  2⤵
  - Program crash
  PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads