0a1c00eb0a1fb543c0b944d074e1969b505c4ff10392b78542b2967def8c74d2 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 13:42

Sharing

Report Analysis Logs

General

Target

b4d616b537e7be2069042d1c04661ae2.exe
Size

214KB
MD5

b4d616b537e7be2069042d1c04661ae2
SHA1

1ea5321f086adf68a13469c52cb2240d32b53b16
SHA256

0a1c00eb0a1fb543c0b944d074e1969b505c4ff10392b78542b2967def8c74d2
SHA512

2b9ba2c6c36c0fdf3e8c9bc74b038e41e1ba40b140a70cfd8953b2d54f6b50c4f7c2f49843006081a50247d405584794b6486717cdd6b2c0e9a218572edf4287
SSDEEP

6144:yZWXhUCfN6RgQxhhu0ANOFS6x63NczSokshGG:PX/N6TzPjI+uc7N

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	2908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2320	2908	b4d616b537e7be2069042d1c04661ae2.exe	28
PID 2908 wrote to memory of 2320	2908	b4d616b537e7be2069042d1c04661ae2.exe	28
PID 2908 wrote to memory of 2320	2908	b4d616b537e7be2069042d1c04661ae2.exe	28
PID 2908 wrote to memory of 2320	2908	b4d616b537e7be2069042d1c04661ae2.exe	28

C:\Users\Admin\AppData\Local\Temp\b4d616b537e7be2069042d1c04661ae2.exe
"C:\Users\Admin\AppData\Local\Temp\b4d616b537e7be2069042d1c04661ae2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 36
  2⤵
  - Program crash
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download