9bd20b00274c1c83508b4d77e79682b6b6ec7b93273d6f6f57f0c8e02ed6a8da | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 02:33

Sharing

Report Analysis Logs

General

Target

c775cef1be3d4cfa68c51f444f81b44e.exe
Size

116KB
MD5

c775cef1be3d4cfa68c51f444f81b44e
SHA1

45a5fe36f4758229ca17868bea6d0f6ca9829f57
SHA256

9bd20b00274c1c83508b4d77e79682b6b6ec7b93273d6f6f57f0c8e02ed6a8da
SHA512

8881ff5df9460249e30721be7b8c6a3c7645feb308860927cf454fabd39260442b1ab4baa3c8406705b7e2eafff48d57b757327d5a0f169977aca921e0a9452f
SSDEEP

3072:7Gs1v4oMGpzKjPX/Y+fzOgEQJ3Xrmea3ZvdzTjk2:7GsJNKjnY+qpvNjT

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	1152	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1772	1152	c775cef1be3d4cfa68c51f444f81b44e.exe	28
PID 1152 wrote to memory of 1772	1152	c775cef1be3d4cfa68c51f444f81b44e.exe	28
PID 1152 wrote to memory of 1772	1152	c775cef1be3d4cfa68c51f444f81b44e.exe	28
PID 1152 wrote to memory of 1772	1152	c775cef1be3d4cfa68c51f444f81b44e.exe	28

C:\Users\Admin\AppData\Local\Temp\c775cef1be3d4cfa68c51f444f81b44e.exe
"C:\Users\Admin\AppData\Local\Temp\c775cef1be3d4cfa68c51f444f81b44e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 36
  2⤵
  - Program crash
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1152-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download