52caea3ad0fa1860f52edbcaf10b8dda04f032d3f81e98d53e34bf82ab0a6f0d | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 13:54

Sharing

Report Analysis Logs

General

Target

bb6deb2429199cfdae65e89b9e95d022.exe
Size

31KB
MD5

bb6deb2429199cfdae65e89b9e95d022
SHA1

6fa0c9f8c765b13477b50a2019112a9f14619f65
SHA256

52caea3ad0fa1860f52edbcaf10b8dda04f032d3f81e98d53e34bf82ab0a6f0d
SHA512

ebf666819f2a6ef64ea3534b45ca46e4afb120c98c4608af15a9aa1c929d1ebf9037dfeeab0b10412fb888f959e6757c6e8e35d331df0f1360b94764d983d002
SSDEEP

768:ZaSh7TzTBziifTeiZSVWihwEEnh0L7uTLeNfQf9DUh:MSZ/nEEh8uTKN+DQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2208	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2956	2208	bb6deb2429199cfdae65e89b9e95d022.exe	28
PID 2208 wrote to memory of 2956	2208	bb6deb2429199cfdae65e89b9e95d022.exe	28
PID 2208 wrote to memory of 2956	2208	bb6deb2429199cfdae65e89b9e95d022.exe	28
PID 2208 wrote to memory of 2956	2208	bb6deb2429199cfdae65e89b9e95d022.exe	28

C:\Users\Admin\AppData\Local\Temp\bb6deb2429199cfdae65e89b9e95d022.exe
"C:\Users\Admin\AppData\Local\Temp\bb6deb2429199cfdae65e89b9e95d022.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 88
  2⤵
  - Program crash
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download