6c6c30d3386aa64166e6bafeb3e2a342f34d6e8b6e70a741253516d43ce49ced | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 20:41

Sharing

Report Analysis Logs

General

Target

acce5568cee0f0bb67bdd3ad3b4bd8b6.exe
Size

29KB
MD5

acce5568cee0f0bb67bdd3ad3b4bd8b6
SHA1

38f04932036f00a21bde9dabf7fb4996cce685ad
SHA256

6c6c30d3386aa64166e6bafeb3e2a342f34d6e8b6e70a741253516d43ce49ced
SHA512

a5575bd6910da703576172f86c182f9ddb311e17911abb8d64c0280ad932e0bba9fe853784a37e6625baf631395a9caf74a65040f5e12ceadb2925b73957c912
SSDEEP

384:uipJOQPySN65ymsviU6WgZPbPGDnalmo:uiow659DUyjP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 2632	384	acce5568cee0f0bb67bdd3ad3b4bd8b6.exe	28
PID 384 wrote to memory of 2632	384	acce5568cee0f0bb67bdd3ad3b4bd8b6.exe	28
PID 384 wrote to memory of 2632	384	acce5568cee0f0bb67bdd3ad3b4bd8b6.exe	28
PID 384 wrote to memory of 2632	384	acce5568cee0f0bb67bdd3ad3b4bd8b6.exe	28

C:\Users\Admin\AppData\Local\Temp\acce5568cee0f0bb67bdd3ad3b4bd8b6.exe
"C:\Users\Admin\AppData\Local\Temp\acce5568cee0f0bb67bdd3ad3b4bd8b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 92
  2⤵
  - Program crash
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads