6a7d9e18b5442751716c9c9b26a0ef00fe91c687466d05838b39e87f2a6c6294 | Triage

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 20:07

Sharing

Report Analysis Logs

General

Target

acbd00b130ad9072e3d9fe6cc9ffc2b9.exe
Size

10KB
MD5

acbd00b130ad9072e3d9fe6cc9ffc2b9
SHA1

b1d40dd33a3ab1e4dc802d0c43ab42d9b82f76e8
SHA256

6a7d9e18b5442751716c9c9b26a0ef00fe91c687466d05838b39e87f2a6c6294
SHA512

8e46ed5b86289c274ee09d4186b53fb4fdbc549a6ce2fea441b820a3daed11e831fe03e50f88d13dbe9abfdbbc93277039a271371d0546ed0daf5225d1073e31
SSDEEP

192:n7BvKNwJSH7453Ux9HsTG+adm3nQVhXfqY2D+kyx:wUMr/sKUQvXfqY2Y

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1728	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1756	1728	acbd00b130ad9072e3d9fe6cc9ffc2b9.exe	28
PID 1728 wrote to memory of 1756	1728	acbd00b130ad9072e3d9fe6cc9ffc2b9.exe	28
PID 1728 wrote to memory of 1756	1728	acbd00b130ad9072e3d9fe6cc9ffc2b9.exe	28
PID 1728 wrote to memory of 1756	1728	acbd00b130ad9072e3d9fe6cc9ffc2b9.exe	28

C:\Users\Admin\AppData\Local\Temp\acbd00b130ad9072e3d9fe6cc9ffc2b9.exe
"C:\Users\Admin\AppData\Local\Temp\acbd00b130ad9072e3d9fe6cc9ffc2b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 36
  2⤵
  - Program crash
  PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000400000-0x00000000005DE004-memory.dmp

Filesize
1.9MB

Download