900d29c4ed080a1934273921fff33c4660211042bbac84998ed587568ca17c53 | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 15:58

Sharing

Report Analysis Logs

General

Target

c6494a649e018bd0c91d43d535f86b06.exe
Size

57KB
MD5

c6494a649e018bd0c91d43d535f86b06
SHA1

f81c5599b140b454a1c42de2490fe9b3cdb42bec
SHA256

900d29c4ed080a1934273921fff33c4660211042bbac84998ed587568ca17c53
SHA512

76be980fa6b031cb361c00a46d581279aa3a149822d4312f2b2227bd1c43db9261e64345d3d56097d68ff902332593866b8dbf16b88468e2d32eb48bafd8ec6a
SSDEEP

1536:JRnYYTwlbExWiPIJK5qguBETYEgZjwNekc:sYTwhExW5K/uBYisF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	1728	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1420	1728	c6494a649e018bd0c91d43d535f86b06.exe	28
PID 1728 wrote to memory of 1420	1728	c6494a649e018bd0c91d43d535f86b06.exe	28
PID 1728 wrote to memory of 1420	1728	c6494a649e018bd0c91d43d535f86b06.exe	28
PID 1728 wrote to memory of 1420	1728	c6494a649e018bd0c91d43d535f86b06.exe	28

C:\Users\Admin\AppData\Local\Temp\c6494a649e018bd0c91d43d535f86b06.exe
"C:\Users\Admin\AppData\Local\Temp\c6494a649e018bd0c91d43d535f86b06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 108
  2⤵
  - Program crash
  PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download