d1aacb4d95f9bdcc2ecb60b8bdfd79b47d25570fc6ce39643e9183f1f0c86a5b | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 05:52

Sharing

Report Analysis Logs

General

Target

c52362f90b4ea59258146995fcbf7279.exe
Size

111KB
MD5

c52362f90b4ea59258146995fcbf7279
SHA1

68aa660e863517a19f612492db23b3c553b02bda
SHA256

d1aacb4d95f9bdcc2ecb60b8bdfd79b47d25570fc6ce39643e9183f1f0c86a5b
SHA512

10ccea4e6af8bcde38e3bd48934c83d487d7781807e2fbe752fe5739c28e2724eeb668b41bbf0f6ef2538cb4bb8e5587431deccf4c4071e5ac5d69af3f1fa6df
SSDEEP

3072:tre/cWZNk6b7aA/RPzPrXoxL685nsKlKUBEeGYw:tChNJaA2BxlKUeeGYw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	1924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1952	1924	c52362f90b4ea59258146995fcbf7279.exe	28
PID 1924 wrote to memory of 1952	1924	c52362f90b4ea59258146995fcbf7279.exe	28
PID 1924 wrote to memory of 1952	1924	c52362f90b4ea59258146995fcbf7279.exe	28
PID 1924 wrote to memory of 1952	1924	c52362f90b4ea59258146995fcbf7279.exe	28

C:\Users\Admin\AppData\Local\Temp\c52362f90b4ea59258146995fcbf7279.exe
"C:\Users\Admin\AppData\Local\Temp\c52362f90b4ea59258146995fcbf7279.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 36
  2⤵
  - Program crash
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1924-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download