5d39c04e76a4c7dc4aa8b3d08138c61d5a8838ca4df0453d79e403c2e675ef59 | Triage

Analysis

max time kernel
144s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 07:12

Sharing

Report Analysis Logs

General

Target

c2c3a2b83af2467ef0bbf117017facff.exe
Size

938KB
MD5

c2c3a2b83af2467ef0bbf117017facff
SHA1

ed3b08d58c894577976dd8101ae532891669cbfb
SHA256

5d39c04e76a4c7dc4aa8b3d08138c61d5a8838ca4df0453d79e403c2e675ef59
SHA512

43a880e3e92dc4bc1f7516866524a3ce1af84119cd666c225bda7d3d0e2b2cbeb517c0067c718286f49bcb3883077f044fd73b77680570ee58ac1a1c3bfb3a64
SSDEEP

24576:d0l6xhKUDxPGwNYfORbKRHOC948knbKyQegTU:mlyzwwXKw78knbKyQeg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	2176	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2192	2176	c2c3a2b83af2467ef0bbf117017facff.exe	28
PID 2176 wrote to memory of 2192	2176	c2c3a2b83af2467ef0bbf117017facff.exe	28
PID 2176 wrote to memory of 2192	2176	c2c3a2b83af2467ef0bbf117017facff.exe	28
PID 2176 wrote to memory of 2192	2176	c2c3a2b83af2467ef0bbf117017facff.exe	28

C:\Users\Admin\AppData\Local\Temp\c2c3a2b83af2467ef0bbf117017facff.exe
"C:\Users\Admin\AppData\Local\Temp\c2c3a2b83af2467ef0bbf117017facff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 92
  2⤵
  - Program crash
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x0000000000400000-0x0000000001822000-memory.dmp

Filesize
20.1MB

Download