9496dd38ae7350474e7a3422fe5810222b067672a10711ffec560935c5bd0b31 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 14:37

Sharing

Report Analysis Logs

General

Target

b7a52d4cec5b08ff2f2d59c9f246a41b.exe
Size

20KB
MD5

b7a52d4cec5b08ff2f2d59c9f246a41b
SHA1

30808d63c7aa444b1b63281e783132f858aebc45
SHA256

9496dd38ae7350474e7a3422fe5810222b067672a10711ffec560935c5bd0b31
SHA512

4675cd5dbe812019df373913aa381242ebad3e80f4f67bd3c76cf3adde9cf030de727132b24217de685e6043cde899effcda9007650fbdbb5e5a11af48ece071
SSDEEP

384:kLtEGS1Qv6a4G1ZGj6hAYcMpV0zG7vtZTA1+ll03zbf:kLtttKGrG9nGDtZ0clqb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2756	2172	b7a52d4cec5b08ff2f2d59c9f246a41b.exe	28
PID 2172 wrote to memory of 2756	2172	b7a52d4cec5b08ff2f2d59c9f246a41b.exe	28
PID 2172 wrote to memory of 2756	2172	b7a52d4cec5b08ff2f2d59c9f246a41b.exe	28
PID 2172 wrote to memory of 2756	2172	b7a52d4cec5b08ff2f2d59c9f246a41b.exe	28

C:\Users\Admin\AppData\Local\Temp\b7a52d4cec5b08ff2f2d59c9f246a41b.exe
"C:\Users\Admin\AppData\Local\Temp\b7a52d4cec5b08ff2f2d59c9f246a41b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 44
  2⤵
  - Program crash
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads