d8bc4a0aa2a00afa0d2a32fe08a304be74a1412f6d4a0b129529471c259c4630 | Triage

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 21:57

Sharing

Report Analysis Logs

General

Target

b5c2287580f8e32d33dbd67c13eca0bb.exe
Size

59KB
MD5

b5c2287580f8e32d33dbd67c13eca0bb
SHA1

4ec46175bf6443fe30bd28d00df6f5ecf33f6961
SHA256

d8bc4a0aa2a00afa0d2a32fe08a304be74a1412f6d4a0b129529471c259c4630
SHA512

cad258d1a8ef258e244e31395b616eb7eeadc501012de341c9c8fd5734263d6b9838ea43734f767c471a5b9b053e8916b38f79c4300326c703714514baebd277
SSDEEP

1536:9GPrLmKW0jh9qvKqLQWlDCnV+cJeqV7QCZk:9eLmKZIvcADCnV+cJXur

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1712	2168	b5c2287580f8e32d33dbd67c13eca0bb.exe	28
PID 2168 wrote to memory of 1712	2168	b5c2287580f8e32d33dbd67c13eca0bb.exe	28
PID 2168 wrote to memory of 1712	2168	b5c2287580f8e32d33dbd67c13eca0bb.exe	28
PID 2168 wrote to memory of 1712	2168	b5c2287580f8e32d33dbd67c13eca0bb.exe	28

C:\Users\Admin\AppData\Local\Temp\b5c2287580f8e32d33dbd67c13eca0bb.exe
"C:\Users\Admin\AppData\Local\Temp\b5c2287580f8e32d33dbd67c13eca0bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 128
  2⤵
  - Program crash
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000000400000-0x0000000000409400-memory.dmp

Filesize
37KB

Download
memory/2168-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download