0393ab3ca27c78c321f7709fd390b5708d0ebb595c2d76f3adffa7d78f9443cb | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 11:10

Sharing

Report Analysis Logs

General

Target

a3a1241fb75cf5721f9cea9d400d2523.exe
Size

105KB
MD5

a3a1241fb75cf5721f9cea9d400d2523
SHA1

7850c53419bf38fbae6ae7e3467aa2c851a9d755
SHA256

0393ab3ca27c78c321f7709fd390b5708d0ebb595c2d76f3adffa7d78f9443cb
SHA512

2a5801a74093b47cb107e28881a32bda3f8c47a5d2c72aaa123dd79ec30c3fefc5c8157522bc606eb13b0474fc9ca26991c4f11c7faf51304193140004ae805f
SSDEEP

3072:VZkR/jWVUa6jZefeRxjxIlrp3bcZiW8G:VZkq6def8jxIlhYx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2908	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2660	2908	a3a1241fb75cf5721f9cea9d400d2523.exe	28
PID 2908 wrote to memory of 2660	2908	a3a1241fb75cf5721f9cea9d400d2523.exe	28
PID 2908 wrote to memory of 2660	2908	a3a1241fb75cf5721f9cea9d400d2523.exe	28
PID 2908 wrote to memory of 2660	2908	a3a1241fb75cf5721f9cea9d400d2523.exe	28

C:\Users\Admin\AppData\Local\Temp\a3a1241fb75cf5721f9cea9d400d2523.exe
"C:\Users\Admin\AppData\Local\Temp\a3a1241fb75cf5721f9cea9d400d2523.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 36
  2⤵
  - Program crash
  PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download