749f24fe99ba5444af211d1cbc0e873bc22d87b0ba450f50c0210bcefc2022ad | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c3a044634f94b15db64ecf13ff364748.exe
Size

25KB
MD5

c3a044634f94b15db64ecf13ff364748
SHA1

784d3151d6aa3aa783094cb0bad26e1ea82e0fb9
SHA256

749f24fe99ba5444af211d1cbc0e873bc22d87b0ba450f50c0210bcefc2022ad
SHA512

b386f7587d347cac487c8323f88197b88a74e814393ef1cf9546e681f8cac24df76ed85cf1cb95c4566898e5c96df51969ab687b483d56b5a5237b4e5649e259
SSDEEP

768:VS95RTMPLeTYI1Xja9DDjdQcnvRBZMBal0:VMRTMPLvI1XjIDtQcv39l0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	1320	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2344	1320	c3a044634f94b15db64ecf13ff364748.exe	28
PID 1320 wrote to memory of 2344	1320	c3a044634f94b15db64ecf13ff364748.exe	28
PID 1320 wrote to memory of 2344	1320	c3a044634f94b15db64ecf13ff364748.exe	28
PID 1320 wrote to memory of 2344	1320	c3a044634f94b15db64ecf13ff364748.exe	28

C:\Users\Admin\AppData\Local\Temp\c3a044634f94b15db64ecf13ff364748.exe
"C:\Users\Admin\AppData\Local\Temp\c3a044634f94b15db64ecf13ff364748.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 48
  2⤵
  - Program crash
  PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads