3356d6505eecf470918ebf3adff24a49220a5295397bdbe2f660b27bf46e77a8 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 20:58

Sharing

Report Analysis Logs

General

Target

acd7e1a3c158f89447915fa268afafb4.exe
Size

17KB
MD5

acd7e1a3c158f89447915fa268afafb4
SHA1

69645f26bf3c5443302d4de238a7bce0b0c6635d
SHA256

3356d6505eecf470918ebf3adff24a49220a5295397bdbe2f660b27bf46e77a8
SHA512

b33004f431a8d1f9e14794a659fa8d1da08fa0beb4e6947576581618b4552ee068ca77877cc49a503423b0cc0c901401ab1c9f54d62a62b66175db7f0e6a47dc
SSDEEP

384:ocCJ6hq56byZaSQs3E+stpZvDjEyl38NIlR:oOyZzQs3Qtnh2IlR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2692	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2600	2692	acd7e1a3c158f89447915fa268afafb4.exe	28
PID 2692 wrote to memory of 2600	2692	acd7e1a3c158f89447915fa268afafb4.exe	28
PID 2692 wrote to memory of 2600	2692	acd7e1a3c158f89447915fa268afafb4.exe	28
PID 2692 wrote to memory of 2600	2692	acd7e1a3c158f89447915fa268afafb4.exe	28

C:\Users\Admin\AppData\Local\Temp\acd7e1a3c158f89447915fa268afafb4.exe
"C:\Users\Admin\AppData\Local\Temp\acd7e1a3c158f89447915fa268afafb4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 36
  2⤵
  - Program crash
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads