421463e1a9b493dd5e892187ec13cacee157984d01082e556d6d03034f6604e5 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 04:33

Sharing

Report Analysis Logs

General

Target

ab02c8fec4f89b208549a74624163f6c.exe
Size

127KB
MD5

ab02c8fec4f89b208549a74624163f6c
SHA1

612da51bf3c30836bd14bbc9be1c4e7f1d573f8e
SHA256

421463e1a9b493dd5e892187ec13cacee157984d01082e556d6d03034f6604e5
SHA512

242d8fd10edf3824188085f973db0df47f0aeb845bbd3e2cea939b34afd94ebba99aae6060a6876de131c22ee20e0a88865985ec41dfe83548031b20bfe9cac4
SSDEEP

3072:0jc2of1pV79aZyVawUySL7FEO+g1WJ7g2YM9OiRgRYT:0O179DWL76u1K9O7+T

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2492	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2684	2492	ab02c8fec4f89b208549a74624163f6c.exe	28
PID 2492 wrote to memory of 2684	2492	ab02c8fec4f89b208549a74624163f6c.exe	28
PID 2492 wrote to memory of 2684	2492	ab02c8fec4f89b208549a74624163f6c.exe	28
PID 2492 wrote to memory of 2684	2492	ab02c8fec4f89b208549a74624163f6c.exe	28

C:\Users\Admin\AppData\Local\Temp\ab02c8fec4f89b208549a74624163f6c.exe
"C:\Users\Admin\AppData\Local\Temp\ab02c8fec4f89b208549a74624163f6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 36
  2⤵
  - Program crash
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download