0fb4b7945581777bd9efedae0489fcc717754cf97e4435c9a3b0f21212812621 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:36

Sharing

Report Analysis Logs

General

Target

c6eb75a985afdef43a4858aef9b20cbc.exe
Size

9KB
MD5

c6eb75a985afdef43a4858aef9b20cbc
SHA1

ad5facf5a5394ba1aa0bdd2fe0c66cd5b16fd4b1
SHA256

0fb4b7945581777bd9efedae0489fcc717754cf97e4435c9a3b0f21212812621
SHA512

3ccadca41b991c7862fcfbd65681d0e637395ebfc6d7d6d20a1aa9d4edd55e417837646d15ea93270e580cda3e4fc217ed1320d5adb12af8c39c64d9a6cd9140
SSDEEP

192:kbXY1ntBAHuAH7Mbg65fQOdVMZe2LyTu:91tBqbENR6S

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2100	2012	c6eb75a985afdef43a4858aef9b20cbc.exe	28
PID 2012 wrote to memory of 2100	2012	c6eb75a985afdef43a4858aef9b20cbc.exe	28
PID 2012 wrote to memory of 2100	2012	c6eb75a985afdef43a4858aef9b20cbc.exe	28
PID 2012 wrote to memory of 2100	2012	c6eb75a985afdef43a4858aef9b20cbc.exe	28

C:\Users\Admin\AppData\Local\Temp\c6eb75a985afdef43a4858aef9b20cbc.exe
"C:\Users\Admin\AppData\Local\Temp\c6eb75a985afdef43a4858aef9b20cbc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 88
  2⤵
  - Program crash
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2012-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download