50e391c5a8fdbe04f9a497b60b1fa7ff0ba982d28ae0e198418b55707318e72c | Triage

Analysis

max time kernel
134s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

acc93503c0262d1a6176c9f1a67a6e8f.exe
Size

59KB
MD5

acc93503c0262d1a6176c9f1a67a6e8f
SHA1

d3387d95a2a9a66a0a38b36494f4547f1473d0fb
SHA256

50e391c5a8fdbe04f9a497b60b1fa7ff0ba982d28ae0e198418b55707318e72c
SHA512

c4decddc6bb479766a912ac0f747a58d1536e098672eb0ff63790cf0bf7eb26ea5bcb056640741689bb92ecd42e903314752592c5aa44f1d1584b29738210c2e
SSDEEP

1536:X5YpdnMbjGTC0TyxpiEi4Zr0Mf5nhN4w35YYY:X5AlMnGTDexpijMf5rYYY

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3560	1968	WerFault.exe	28
3240	1968	WerFault.exe	28

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3240	1968	acc93503c0262d1a6176c9f1a67a6e8f.exe	93
PID 1968 wrote to memory of 3240	1968	acc93503c0262d1a6176c9f1a67a6e8f.exe	93
PID 1968 wrote to memory of 3240	1968	acc93503c0262d1a6176c9f1a67a6e8f.exe	93

C:\Users\Admin\AppData\Local\Temp\acc93503c0262d1a6176c9f1a67a6e8f.exe
"C:\Users\Admin\AppData\Local\Temp\acc93503c0262d1a6176c9f1a67a6e8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 408
  2⤵
  - Program crash
  PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 408
  2⤵
  - Program crash
  PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1968 -ip 1968
1⤵
PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1968-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download