409ee0aa881abb3445cf5df6af6473701cb917e8941e4f8cdf33ec3ce9ddff40 | Triage

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 02:19

Sharing

Report Analysis Logs

General

Target

c235bb8d09114183862db14d5b423968.exe
Size

323KB
MD5

c235bb8d09114183862db14d5b423968
SHA1

269d9ef5206a9034e8001a78f4ddfe88a6fabd1b
SHA256

409ee0aa881abb3445cf5df6af6473701cb917e8941e4f8cdf33ec3ce9ddff40
SHA512

4429e64ef65bbe9500c26b83786b51a0f84ba9399ecb751029b7f92b72bb1c9675e8ac4df5c280c6a34aaf2039c01a204860140b442feb0c3e424013d763b754
SSDEEP

6144:ImQgtwB7Mlljd3rKzwN8Jlljd3njPX9ZAk3fs:NQ0mqjpKXjtjP9Zt0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1440	2272	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1440	2272	c235bb8d09114183862db14d5b423968.exe	28
PID 2272 wrote to memory of 1440	2272	c235bb8d09114183862db14d5b423968.exe	28
PID 2272 wrote to memory of 1440	2272	c235bb8d09114183862db14d5b423968.exe	28
PID 2272 wrote to memory of 1440	2272	c235bb8d09114183862db14d5b423968.exe	28

C:\Users\Admin\AppData\Local\Temp\c235bb8d09114183862db14d5b423968.exe
"C:\Users\Admin\AppData\Local\Temp\c235bb8d09114183862db14d5b423968.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 140
  2⤵
  - Program crash
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2272-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2272-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download