e8f8e4dd8ee895a579571fa231c92c5cff64e6c4cb5d83dbb8d8e3e9233e4e14 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 22:12

Sharing

Report Analysis Logs

General

Target

c43c1eaf5e72f8e8150e820e6e9e6c49.exe
Size

904KB
MD5

c43c1eaf5e72f8e8150e820e6e9e6c49
SHA1

15ec8ca646726ddc44f4fb69031b2868e85acbbc
SHA256

e8f8e4dd8ee895a579571fa231c92c5cff64e6c4cb5d83dbb8d8e3e9233e4e14
SHA512

b43731a29304892df592c3788b213685e0dfef84951d6fc359ae9f0be0a6400820b1bb7a905f8ef03010b1b7d698c76d898f2400353a3038410a7c35cfb8da66
SSDEEP

3072:ft2cWtTBfVkfqM2SCAygRjlIqZoFzJcqA:hWtTBdsqEPxjjoFzC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2776	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2268	2776	c43c1eaf5e72f8e8150e820e6e9e6c49.exe	28
PID 2776 wrote to memory of 2268	2776	c43c1eaf5e72f8e8150e820e6e9e6c49.exe	28
PID 2776 wrote to memory of 2268	2776	c43c1eaf5e72f8e8150e820e6e9e6c49.exe	28
PID 2776 wrote to memory of 2268	2776	c43c1eaf5e72f8e8150e820e6e9e6c49.exe	28

C:\Users\Admin\AppData\Local\Temp\c43c1eaf5e72f8e8150e820e6e9e6c49.exe
"C:\Users\Admin\AppData\Local\Temp\c43c1eaf5e72f8e8150e820e6e9e6c49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 36
  2⤵
  - Program crash
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads