b933240941c3942fb52da049a9725263a3aee845b279bd8f869dca4901f9b9e2 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 17:11

Sharing

Report Analysis Logs

General

Target

c3e958f39d71849906051ac3f1f122a7.exe
Size

29KB
MD5

c3e958f39d71849906051ac3f1f122a7
SHA1

1b72fa6edde986549e9842211fe930d7ae5a5a83
SHA256

b933240941c3942fb52da049a9725263a3aee845b279bd8f869dca4901f9b9e2
SHA512

78c570f15d19ac7bba02453fccec6c896c91f3faa3421ccc7647333ca18f906e13a32c96d1593ba3c652b8ed087daff9f8d046676f0606da721acae04b6b0214
SSDEEP

768:rmwjTmtReaItIRBJcbH/wJPUe+O8/PvzFc:rEiYD4pe+3Zc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2884	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2528	2884	c3e958f39d71849906051ac3f1f122a7.exe	28
PID 2884 wrote to memory of 2528	2884	c3e958f39d71849906051ac3f1f122a7.exe	28
PID 2884 wrote to memory of 2528	2884	c3e958f39d71849906051ac3f1f122a7.exe	28
PID 2884 wrote to memory of 2528	2884	c3e958f39d71849906051ac3f1f122a7.exe	28

C:\Users\Admin\AppData\Local\Temp\c3e958f39d71849906051ac3f1f122a7.exe
"C:\Users\Admin\AppData\Local\Temp\c3e958f39d71849906051ac3f1f122a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 36
  2⤵
  - Program crash
  PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-0-0x0000000000400000-0x000000000041B600-memory.dmp

Filesize
109KB

Download
memory/2884-1-0x0000000000400000-0x000000000041B600-memory.dmp

Filesize
109KB

Download