90f36bdc9d2102957f7f94f8790df2b9ffb65d5892a89949af92808e0b661720 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b40e424fcbee6fc3512fac4b3d333d9e.exe
Size

128KB
MD5

b40e424fcbee6fc3512fac4b3d333d9e
SHA1

616cebf044108de1a09ab5a7f7157085083f013a
SHA256

90f36bdc9d2102957f7f94f8790df2b9ffb65d5892a89949af92808e0b661720
SHA512

4205c0295933d4281a52469e3585484a704c571aa6a1cbe11b232fd2f1e39a892f9dd4928511fc42bb5d7f828b82c85ee8dd211797d1d0e19cd1eb4c68da6766
SSDEEP

3072:VZz7cKc6S704U36F550NZ/SpmLghhdDmh/37h:VV7k7I6F55E8mLCmh/37h

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1196	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2184	1196	b40e424fcbee6fc3512fac4b3d333d9e.exe	28
PID 1196 wrote to memory of 2184	1196	b40e424fcbee6fc3512fac4b3d333d9e.exe	28
PID 1196 wrote to memory of 2184	1196	b40e424fcbee6fc3512fac4b3d333d9e.exe	28
PID 1196 wrote to memory of 2184	1196	b40e424fcbee6fc3512fac4b3d333d9e.exe	28

C:\Users\Admin\AppData\Local\Temp\b40e424fcbee6fc3512fac4b3d333d9e.exe
"C:\Users\Admin\AppData\Local\Temp\b40e424fcbee6fc3512fac4b3d333d9e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 36
  2⤵
  - Program crash
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1196-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download