cb8e7e567b6d898cc7c08f9c0a9bcfa9dc6fadbb665001075f2fd031cde06c9c | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

abb6759910762490f14732725a13f7bd.exe
Size

1.6MB
MD5

abb6759910762490f14732725a13f7bd
SHA1

f23de5801b1eb31a64e25704fb2a59a1a08bc0be
SHA256

cb8e7e567b6d898cc7c08f9c0a9bcfa9dc6fadbb665001075f2fd031cde06c9c
SHA512

c9ed97ac6f54812e79d047dea177dc0d39afd358eca8516b0f316d9134df7b809ccf54368bb2899486800161bbab7eef54e4c8a838c88cb8bcc837a520a615a9
SSDEEP

49152:gTUYQgyrdHojE9/LpY6p2U58yyE/Kd/bj:gwY/KIjE9DpkU5F/w

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1436	2220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1436	2220	abb6759910762490f14732725a13f7bd.exe	28
PID 2220 wrote to memory of 1436	2220	abb6759910762490f14732725a13f7bd.exe	28
PID 2220 wrote to memory of 1436	2220	abb6759910762490f14732725a13f7bd.exe	28
PID 2220 wrote to memory of 1436	2220	abb6759910762490f14732725a13f7bd.exe	28

C:\Users\Admin\AppData\Local\Temp\abb6759910762490f14732725a13f7bd.exe
"C:\Users\Admin\AppData\Local\Temp\abb6759910762490f14732725a13f7bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 180
  2⤵
  - Program crash
  PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads