9b7110edf32f235d590b8141ba6aa81eb3414e3202ff0feefcb2160e655c0116 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 21:48

Sharing

Report Analysis Logs

General

Target

32.exe
Size

72KB
MD5

fb003fc48dbad9290735c9a6601381f7
SHA1

49086b4036de3d990d0120697553f686091b2cd9
SHA256

9b7110edf32f235d590b8141ba6aa81eb3414e3202ff0feefcb2160e655c0116
SHA512

690877ca9798f1b6bbf67199fa55d939428b87888d99e2f730cad4b1aa0d37938622ce265a19fac2e0778237bf6fe1bc0cb773d5f7be5219800ad4a3d850604b
SSDEEP

1536:I5iY0kL68xGkUOHfUgxCraXuso9aMb+KR0Nc8QsJq39:UJG8xjTdxU4us0ae0Nc8QsC9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2696	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2076	2696	32.exe	28
PID 2696 wrote to memory of 2076	2696	32.exe	28
PID 2696 wrote to memory of 2076	2696	32.exe	28
PID 2696 wrote to memory of 2076	2696	32.exe	28

C:\Users\Admin\AppData\Local\Temp\32.exe
"C:\Users\Admin\AppData\Local\Temp\32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 64
  2⤵
  - Program crash
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads