7e9603bb4c453d39839158cc8d882560cbdaeb5a76a8ff0fda73bf6e29cf6c34 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 16:11

Sharing

Report Analysis Logs

General

Target

bf089dbf263233ae7bb465945f5c693d.exe
Size

58KB
MD5

bf089dbf263233ae7bb465945f5c693d
SHA1

54900d01d18bb291c79b31364f1b9c3af3e89443
SHA256

7e9603bb4c453d39839158cc8d882560cbdaeb5a76a8ff0fda73bf6e29cf6c34
SHA512

2d0edf2f2889324691d905546ece9d40b5df050e9c0094ed9c615bc9eab4fb7f5731ec1fc1475737d23979d31a59a73848469d256bff703705fd979f0ae081b9
SSDEEP

1536:Xul2fp+Wnskn7PEV6emL9/1JAw1AJHdWfr7DSHIcjn:6up+Vkn7PQhmZ/chFZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2992	2928	bf089dbf263233ae7bb465945f5c693d.exe	28
PID 2928 wrote to memory of 2992	2928	bf089dbf263233ae7bb465945f5c693d.exe	28
PID 2928 wrote to memory of 2992	2928	bf089dbf263233ae7bb465945f5c693d.exe	28
PID 2928 wrote to memory of 2992	2928	bf089dbf263233ae7bb465945f5c693d.exe	28

C:\Users\Admin\AppData\Local\Temp\bf089dbf263233ae7bb465945f5c693d.exe
"C:\Users\Admin\AppData\Local\Temp\bf089dbf263233ae7bb465945f5c693d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 120
  2⤵
  - Program crash
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-0-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download