b435c364e8d41086dd4cc59c5c056569103cfda13e8666a9c05f7a9f3a5bb289 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 12:11

Sharing

Report Analysis Logs

General

Target

c5d7afba8d991fc2ad0723f3ded17462.exe
Size

65KB
MD5

c5d7afba8d991fc2ad0723f3ded17462
SHA1

3e7bfd8be79d5efc9d1f2cd0388a255e262c69c4
SHA256

b435c364e8d41086dd4cc59c5c056569103cfda13e8666a9c05f7a9f3a5bb289
SHA512

41bb70dd47558259c77960bf45a151b2aded84181e5a6a25cd2857df1f52fc1c2b662cd87fc9761954e403dfb954f55380f0240a8076b83667e0980f8a2806eb
SSDEEP

768:NzS7vkxEwhjl8H2iaT1B0jBGndeRl8pWCgt/PRlxY:VAIjgm1B0FGdeRTCgt/5Y

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	1908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1920	1908	c5d7afba8d991fc2ad0723f3ded17462.exe	28
PID 1908 wrote to memory of 1920	1908	c5d7afba8d991fc2ad0723f3ded17462.exe	28
PID 1908 wrote to memory of 1920	1908	c5d7afba8d991fc2ad0723f3ded17462.exe	28
PID 1908 wrote to memory of 1920	1908	c5d7afba8d991fc2ad0723f3ded17462.exe	28

C:\Users\Admin\AppData\Local\Temp\c5d7afba8d991fc2ad0723f3ded17462.exe
"C:\Users\Admin\AppData\Local\Temp\c5d7afba8d991fc2ad0723f3ded17462.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 44
  2⤵
  - Program crash
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1908-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download