b95e67c401b2591d8e8accfe5bc23606e4898614cbceb17af159549d235b7af5 | Triage

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

baf6cca2e2c24c138af6632888d2c062.exe
Size

136KB
MD5

baf6cca2e2c24c138af6632888d2c062
SHA1

0123026616a1e6da9b9b942e2153ab2805e64299
SHA256

b95e67c401b2591d8e8accfe5bc23606e4898614cbceb17af159549d235b7af5
SHA512

7e8e291fad689afd02f19a49318089c6877395b3e3914237630937b26066b67dc6dd4915f1676331e7881e6f457e63d81a2f00f5f17c8507dc2c63bffb01e997
SSDEEP

3072:Ib4bp46ejI5o45ATPCRS1cb6Bk4sq7pW5pUY:x94NJPSS106O4sw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2624	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2576	2624	baf6cca2e2c24c138af6632888d2c062.exe	27
PID 2624 wrote to memory of 2576	2624	baf6cca2e2c24c138af6632888d2c062.exe	27
PID 2624 wrote to memory of 2576	2624	baf6cca2e2c24c138af6632888d2c062.exe	27
PID 2624 wrote to memory of 2576	2624	baf6cca2e2c24c138af6632888d2c062.exe	27

C:\Users\Admin\AppData\Local\Temp\baf6cca2e2c24c138af6632888d2c062.exe
"C:\Users\Admin\AppData\Local\Temp\baf6cca2e2c24c138af6632888d2c062.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 36
  2⤵
  - Program crash
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2624-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download