629ee970bb0e488d6ab6e4a416d2de6da509fb76a4c00c25f3c59da1411a920e | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 11:25

Sharing

Report Analysis Logs

General

Target

c5c0f6ccfd60c6d2aed10f4879094e94.exe
Size

9KB
MD5

c5c0f6ccfd60c6d2aed10f4879094e94
SHA1

7c4a1420c02c5a9fdb01f8eea3b90c7a98371174
SHA256

629ee970bb0e488d6ab6e4a416d2de6da509fb76a4c00c25f3c59da1411a920e
SHA512

bc03ddd7f0819c1539c9503a41dc836dc4629c58dc04f933e81bdc5ec39efb91f4abd8b4259ab53f6d6200aff584c9c2d41c6394dd4684bb547375d9fcfc48d9
SSDEEP

192:oU4oA0ReN8m6eQCVEGbnDFKU4cYKJ49ooKAA5:zXe1FDIU4XKJ49oVh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1440	2272	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1440	2272	c5c0f6ccfd60c6d2aed10f4879094e94.exe	28
PID 2272 wrote to memory of 1440	2272	c5c0f6ccfd60c6d2aed10f4879094e94.exe	28
PID 2272 wrote to memory of 1440	2272	c5c0f6ccfd60c6d2aed10f4879094e94.exe	28
PID 2272 wrote to memory of 1440	2272	c5c0f6ccfd60c6d2aed10f4879094e94.exe	28

C:\Users\Admin\AppData\Local\Temp\c5c0f6ccfd60c6d2aed10f4879094e94.exe
"C:\Users\Admin\AppData\Local\Temp\c5c0f6ccfd60c6d2aed10f4879094e94.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 88
  2⤵
  - Program crash
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2272-0-0x0000000000400000-0x0000000000407FCC-memory.dmp

Filesize
31KB

Download
memory/2272-1-0x0000000000400000-0x0000000000407FCC-memory.dmp

Filesize
31KB

Download