0ce0682abb75b00b32858e270246e168799e2618f671edd3da16680586fb306f | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 20:31

Sharing

Report Analysis Logs

General

Target

avzthbaywy.exe
Size

289KB
MD5

13c80abd753e9c38782524743504a0dd
SHA1

709129996e9d1474f57ed77eb38794d82f9805c4
SHA256

d718c0c41640eefcd910fd40f970e3e47a025352602bd8c0e53ab7baeaba1aa0
SHA512

828830e4ac3c8757ae9d8602415570768903620912d8dcaac87207b9cf054e6ae5a14b2372451160776901a067079a853ef5606114848afee2b440f6279b662f
SSDEEP

6144:54kPEeNtgeA+2OSlbnb1CsLR6Hp7Xu/0DHblcqD/L:54kPEeNtR2OSlbhV6Fu/0dc+L

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2900 2896 WerFault.exe avzthbaywy.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

avzthbaywy.exe

description	pid	process	target process
PID 2896 wrote to memory of 2900	2896	avzthbaywy.exe	WerFault.exe
PID 2896 wrote to memory of 2900	2896	avzthbaywy.exe	WerFault.exe
PID 2896 wrote to memory of 2900	2896	avzthbaywy.exe	WerFault.exe
PID 2896 wrote to memory of 2900	2896	avzthbaywy.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\avzthbaywy.exe
"C:\Users\Admin\AppData\Local\Temp\avzthbaywy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 212
2⤵
- Program crash
PID:2900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...