bc225199742af2d57aec13a56f617108acb64b071bda797a65f1a3c874944aaf | Triage

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 13:26

Sharing

Report Analysis Logs

General

Target

bbebb97b3783c223b15d1156e1a3764f.exe
Size

103KB
MD5

bbebb97b3783c223b15d1156e1a3764f
SHA1

8631dede7a2634670449aa86e018be7b8581eea7
SHA256

bc225199742af2d57aec13a56f617108acb64b071bda797a65f1a3c874944aaf
SHA512

07e8e84873c77596a926bbbce1fce5997cb485f1957da6dcbb1d4d7d44c133de024832b72b871b17337348c5a72123c538856ffa8f7fc300a9dfd097296b0d8a
SSDEEP

3072:vinlJR5E3c1bEfPM9sUiDYhH0oEf7NATnTz:vinlJRaeEfPM9gYhH0oVTn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2496	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2704	2496	bbebb97b3783c223b15d1156e1a3764f.exe	28
PID 2496 wrote to memory of 2704	2496	bbebb97b3783c223b15d1156e1a3764f.exe	28
PID 2496 wrote to memory of 2704	2496	bbebb97b3783c223b15d1156e1a3764f.exe	28
PID 2496 wrote to memory of 2704	2496	bbebb97b3783c223b15d1156e1a3764f.exe	28

C:\Users\Admin\AppData\Local\Temp\bbebb97b3783c223b15d1156e1a3764f.exe
"C:\Users\Admin\AppData\Local\Temp\bbebb97b3783c223b15d1156e1a3764f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 36
  2⤵
  - Program crash
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download