9ef452f2c1cd84118de59ac7415ed9f37bd9a82bd5c893f1b6efb7900221c861 | Triage

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b80ad5f34ab108318893edca4d7e4c83.exe
Size

323KB
MD5

b80ad5f34ab108318893edca4d7e4c83
SHA1

1f53906dcd4c0f24e685b22281c6ee4c39c758b1
SHA256

9ef452f2c1cd84118de59ac7415ed9f37bd9a82bd5c893f1b6efb7900221c861
SHA512

b54a3e366ecec4de43799f5941f1bacdb79f6d5e855b9c3f98b31c095b6d6b69149c170c4355bfbf3c1392fa01da81de9611ddfa1d41e00b023f86e88ca1d1e9
SSDEEP

6144:3WUG2G2Nlljd3rKzwN8Jlljd3njPX9ZAk3fs:3WqjpKXjtjP9Zt0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	1996	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2076	1996	b80ad5f34ab108318893edca4d7e4c83.exe	28
PID 1996 wrote to memory of 2076	1996	b80ad5f34ab108318893edca4d7e4c83.exe	28
PID 1996 wrote to memory of 2076	1996	b80ad5f34ab108318893edca4d7e4c83.exe	28
PID 1996 wrote to memory of 2076	1996	b80ad5f34ab108318893edca4d7e4c83.exe	28

C:\Users\Admin\AppData\Local\Temp\b80ad5f34ab108318893edca4d7e4c83.exe
"C:\Users\Admin\AppData\Local\Temp\b80ad5f34ab108318893edca4d7e4c83.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 140
  2⤵
  - Program crash
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1996-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download