b04b456f2cff26a437be7395b97a597928a8319faf88b2c13f981e88cfca615a | Triage

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 16:48

Sharing

Report Analysis Logs

General

Target

a449f8e48652b7bdac1000b98e46f259.exe
Size

279KB
MD5

a449f8e48652b7bdac1000b98e46f259
SHA1

6ee4eb6ed90108087d29c821948476110b2e099b
SHA256

b04b456f2cff26a437be7395b97a597928a8319faf88b2c13f981e88cfca615a
SHA512

a09bee7985e753ff3542533622e944aba5746ed5d11cdae2d3ef3beb5cf366ad4db5952d0bb95d557f16c717b41cf7dae4890887acafc374c040885c14f3a1f4
SSDEEP

6144:G0U+Swr9fzfqn6k9L5HBh1oGgAaNMHZe3Lj:jU+S09fzfq6EhgR/dLj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2628	WerFault.exe	5

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2920	2628	a449f8e48652b7bdac1000b98e46f259.exe	27
PID 2628 wrote to memory of 2920	2628	a449f8e48652b7bdac1000b98e46f259.exe	27
PID 2628 wrote to memory of 2920	2628	a449f8e48652b7bdac1000b98e46f259.exe	27
PID 2628 wrote to memory of 2920	2628	a449f8e48652b7bdac1000b98e46f259.exe	27

C:\Users\Admin\AppData\Local\Temp\a449f8e48652b7bdac1000b98e46f259.exe
"C:\Users\Admin\AppData\Local\Temp\a449f8e48652b7bdac1000b98e46f259.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 204
  2⤵
  - Program crash
  PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-0-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2628-1-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download