ac389ce1dd53626cabf45fb66f85e51ff1db8a6bdb7efb43024f39da9aabaec7 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 04:28

Sharing

Report Analysis Logs

General

Target

ab00beff964f4d02a237b30742130d10.exe
Size

30KB
MD5

ab00beff964f4d02a237b30742130d10
SHA1

d3fd396576aa0c2057728da676dc8c3aea416f8c
SHA256

ac389ce1dd53626cabf45fb66f85e51ff1db8a6bdb7efb43024f39da9aabaec7
SHA512

c2265d3ee7a086682c5d46deef3077bd02fcd051ee5638e9deda6a90d7852a86d9518d31a6e06ffb1025a20ebfa9dccf5bdc9585c93d01d10f5a5c1efd099907
SSDEEP

768:PlUvnbcfV6i+vj0AW3tLOXoyFARkkIRmNz+jtS16Z:tco4vvQAWdSX7yhQRS1u

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2460	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2988	2460	ab00beff964f4d02a237b30742130d10.exe	28
PID 2460 wrote to memory of 2988	2460	ab00beff964f4d02a237b30742130d10.exe	28
PID 2460 wrote to memory of 2988	2460	ab00beff964f4d02a237b30742130d10.exe	28
PID 2460 wrote to memory of 2988	2460	ab00beff964f4d02a237b30742130d10.exe	28

C:\Users\Admin\AppData\Local\Temp\ab00beff964f4d02a237b30742130d10.exe
"C:\Users\Admin\AppData\Local\Temp\ab00beff964f4d02a237b30742130d10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 88
  2⤵
  - Program crash
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads