1a01f57a8adcb2f89ab0e104cd6e1b3d3765a9856e79a4a19da7b17b8781e8d0 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 13:41

Sharing

Report Analysis Logs

General

Target

b789a3e4eb881cb45624f9d7160185c9.exe
Size

102KB
MD5

b789a3e4eb881cb45624f9d7160185c9
SHA1

c811289889e8f1b73969cf72a985af8f97d5d779
SHA256

1a01f57a8adcb2f89ab0e104cd6e1b3d3765a9856e79a4a19da7b17b8781e8d0
SHA512

9afdc053bc276235ac6da43ad63ba54eed4c2791892e8e63e73ca9bbeb8c6c7f5d074d0efa71982b7526a8a010482a07e41e669c8d8ecfdf581018886badb52f
SSDEEP

3072:sz6f8wF2JRiBbcIN5F7cgKFnPgZPBQ3G/pcI:Df8y2J8cIN7coF4GRcI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2600	3012	b789a3e4eb881cb45624f9d7160185c9.exe	28
PID 3012 wrote to memory of 2600	3012	b789a3e4eb881cb45624f9d7160185c9.exe	28
PID 3012 wrote to memory of 2600	3012	b789a3e4eb881cb45624f9d7160185c9.exe	28
PID 3012 wrote to memory of 2600	3012	b789a3e4eb881cb45624f9d7160185c9.exe	28

C:\Users\Admin\AppData\Local\Temp\b789a3e4eb881cb45624f9d7160185c9.exe
"C:\Users\Admin\AppData\Local\Temp\b789a3e4eb881cb45624f9d7160185c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 36
  2⤵
  - Program crash
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3012-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download