299b09bf74fb9d1d548a8cd7006dfe1dc14bb152c5238d3945b5da7a6bc7440f | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 06:59

Sharing

Report Analysis Logs

General

Target

bacf67e765a0dd6c5b3d0172983acfeb.exe
Size

114KB
MD5

bacf67e765a0dd6c5b3d0172983acfeb
SHA1

7618cb3eab9c2b555644893d74275004b58ddce5
SHA256

299b09bf74fb9d1d548a8cd7006dfe1dc14bb152c5238d3945b5da7a6bc7440f
SHA512

e0668d5a9ebad2daa27645124cfab8d1ea946cce540f7ff1428e5949ae6d9818a72e76cc9010abd081a71c37d2a2e362f8167dcd67d7a12840de341d1f4732d8
SSDEEP

3072:fnlGZn4iPVLE/6S2UkRW22435KgmilegTV56fU:NZKNE/6Sc9HpJmioix

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	2112	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2588	2112	bacf67e765a0dd6c5b3d0172983acfeb.exe	28
PID 2112 wrote to memory of 2588	2112	bacf67e765a0dd6c5b3d0172983acfeb.exe	28
PID 2112 wrote to memory of 2588	2112	bacf67e765a0dd6c5b3d0172983acfeb.exe	28
PID 2112 wrote to memory of 2588	2112	bacf67e765a0dd6c5b3d0172983acfeb.exe	28

C:\Users\Admin\AppData\Local\Temp\bacf67e765a0dd6c5b3d0172983acfeb.exe
"C:\Users\Admin\AppData\Local\Temp\bacf67e765a0dd6c5b3d0172983acfeb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 36
  2⤵
  - Program crash
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2112-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download