e401d59adf6a7f956e5525db25db4709cd44faa1b4bc6d8a072a4fb73b20f476 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 11:54

Sharing

Report Analysis Logs

General

Target

bb320240dbda29038c177bc6bba14c7a.exe
Size

28KB
MD5

bb320240dbda29038c177bc6bba14c7a
SHA1

4620429a525e1f863fd35241596be56270f7a72c
SHA256

e401d59adf6a7f956e5525db25db4709cd44faa1b4bc6d8a072a4fb73b20f476
SHA512

194ab002527c572bcf977010b4f8d43b5542488d4808ba94169522ddba7b18e60f83f3770ab5e8e4266d0121f1462f576c25cd08d6008367bb89beeafc06a187
SSDEEP

384:MOk9SugAidB0If/PoW1ucglccFTPvF8YmL8SF6ZRXuU:+9ct3PhucsdigPP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2856	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2056	2856	bb320240dbda29038c177bc6bba14c7a.exe	28
PID 2856 wrote to memory of 2056	2856	bb320240dbda29038c177bc6bba14c7a.exe	28
PID 2856 wrote to memory of 2056	2856	bb320240dbda29038c177bc6bba14c7a.exe	28
PID 2856 wrote to memory of 2056	2856	bb320240dbda29038c177bc6bba14c7a.exe	28

C:\Users\Admin\AppData\Local\Temp\bb320240dbda29038c177bc6bba14c7a.exe
"C:\Users\Admin\AppData\Local\Temp\bb320240dbda29038c177bc6bba14c7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 72
  2⤵
  - Program crash
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads