326456dd24996db64f367a9033c86b575279bd55ccf4bbb6ab406b659b27fdb3 | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 07:54

Sharing

Report Analysis Logs

General

Target

a34264b78e3991af95dbfd722e811a99.exe
Size

27KB
MD5

a34264b78e3991af95dbfd722e811a99
SHA1

050f2bfb5557197e51762fa33bff83e9c9dd4fd9
SHA256

326456dd24996db64f367a9033c86b575279bd55ccf4bbb6ab406b659b27fdb3
SHA512

597d14f8b4dfa1f38bba33eaea55dfba4ec7e5347bb23f82d230394a62d61617a9eb0bfd4c3dcdbd584cc8f5eff277c4e0bd86215a916c16e998f40f238c8458
SSDEEP

768:JdXSoa32rWTHg4vvA0RpKTdapAULKtOHVjE:nXLw2/4HPRpzpAl7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	2040	WerFault.exe	12

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 864	2040	a34264b78e3991af95dbfd722e811a99.exe	28
PID 2040 wrote to memory of 864	2040	a34264b78e3991af95dbfd722e811a99.exe	28
PID 2040 wrote to memory of 864	2040	a34264b78e3991af95dbfd722e811a99.exe	28
PID 2040 wrote to memory of 864	2040	a34264b78e3991af95dbfd722e811a99.exe	28

C:\Users\Admin\AppData\Local\Temp\a34264b78e3991af95dbfd722e811a99.exe
"C:\Users\Admin\AppData\Local\Temp\a34264b78e3991af95dbfd722e811a99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 44
  2⤵
  - Program crash
  PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000000520000-0x000000000053D000-memory.dmp

Filesize
116KB

Download
memory/2040-1-0x0000000000020000-0x000000000003A000-memory.dmp

Filesize
104KB

Download