caba17352ca54250ef8d4579881632712d28366d6433dd005017dc38798a9894 | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 00:10

Sharing

Report Analysis Logs

General

Target

c73209ce1b992ea9b5f4ffb52e168a19.exe
Size

140KB
MD5

c73209ce1b992ea9b5f4ffb52e168a19
SHA1

c6c606526a837ec643695488fac361d0c4b3038d
SHA256

caba17352ca54250ef8d4579881632712d28366d6433dd005017dc38798a9894
SHA512

da4c06fb68205669e34953787d6e125e7d47092504877d89a6143202a214afaf4e00facce54aeb9d2d36a444fbe15ae2b5de242678bd5556150db10458b2c6c3
SSDEEP

3072:oiZCow0Zw9yYh7P+6QT/BUqYnJlb2inEm5N:/XboyYRe/RYnJJ25m

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
1900	1936	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1900	1936	c73209ce1b992ea9b5f4ffb52e168a19.exe	28
PID 1936 wrote to memory of 1900	1936	c73209ce1b992ea9b5f4ffb52e168a19.exe	28
PID 1936 wrote to memory of 1900	1936	c73209ce1b992ea9b5f4ffb52e168a19.exe	28
PID 1936 wrote to memory of 1900	1936	c73209ce1b992ea9b5f4ffb52e168a19.exe	28

C:\Users\Admin\AppData\Local\Temp\c73209ce1b992ea9b5f4ffb52e168a19.exe
"C:\Users\Admin\AppData\Local\Temp\c73209ce1b992ea9b5f4ffb52e168a19.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 36
  2⤵
  - Program crash
  PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download