f95569196ce7fab45947d86636636bd692b8b326a4b7fcef369986c9878f04c4 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 00:12

Sharing

Report Analysis Logs

General

Target

c7331e56cddf4d65aa7a5a5dc776ee56.exe
Size

73KB
MD5

c7331e56cddf4d65aa7a5a5dc776ee56
SHA1

bc225e07802fa5c1359a84a0b14e0ed90e874b35
SHA256

f95569196ce7fab45947d86636636bd692b8b326a4b7fcef369986c9878f04c4
SHA512

f59dc8b4b1a8f0c3e87904efd88ab1ed63dbad2b2def729dd52bce7f64b40fe6a0172b41760d5821f32cbdfa4220fe05299ee649a9db4153fbd92d3c3f1d5b72
SSDEEP

1536:Ryw2wM4+EtrTcW9fxlVSf4tjOl29RDfO4:Ryw2wM4+E1TX9fxptjOo9R6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	1800	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2820	1800	c7331e56cddf4d65aa7a5a5dc776ee56.exe	28
PID 1800 wrote to memory of 2820	1800	c7331e56cddf4d65aa7a5a5dc776ee56.exe	28
PID 1800 wrote to memory of 2820	1800	c7331e56cddf4d65aa7a5a5dc776ee56.exe	28
PID 1800 wrote to memory of 2820	1800	c7331e56cddf4d65aa7a5a5dc776ee56.exe	28

C:\Users\Admin\AppData\Local\Temp\c7331e56cddf4d65aa7a5a5dc776ee56.exe
"C:\Users\Admin\AppData\Local\Temp\c7331e56cddf4d65aa7a5a5dc776ee56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 144
  2⤵
  - Program crash
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-0-0x0000000000400000-0x0000000000437400-memory.dmp

Filesize
221KB

Download