1d9fabd8febd01fb03f0f9e0ccbe4a616e0af424cb4e712e87db3655c8c5a315 | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 20:51

Sharing

Report Analysis Logs

General

Target

c191c2ec63e52fb49120b462186539bf.exe
Size

56KB
MD5

c191c2ec63e52fb49120b462186539bf
SHA1

af176d336f8e88c97b679ea44ba4dd8d9e5e2d03
SHA256

1d9fabd8febd01fb03f0f9e0ccbe4a616e0af424cb4e712e87db3655c8c5a315
SHA512

99d49884afd90964df4db01a40cb73eea6674d2e3aac8089db744ecadfe0dce033e2fa23f5af106f0368dedb1a25814686f481823bde1bd5e3c3bd152eed37b9
SSDEEP

1536:/LCGMO8cziYvomNY1lw+it14268XiddV2hMKf:jCGPf7o9mydXNKf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	2844	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2012	2844	c191c2ec63e52fb49120b462186539bf.exe	28
PID 2844 wrote to memory of 2012	2844	c191c2ec63e52fb49120b462186539bf.exe	28
PID 2844 wrote to memory of 2012	2844	c191c2ec63e52fb49120b462186539bf.exe	28
PID 2844 wrote to memory of 2012	2844	c191c2ec63e52fb49120b462186539bf.exe	28

C:\Users\Admin\AppData\Local\Temp\c191c2ec63e52fb49120b462186539bf.exe
"C:\Users\Admin\AppData\Local\Temp\c191c2ec63e52fb49120b462186539bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 140
  2⤵
  - Program crash
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2844-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2844-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download