cfefc55c998333b7044417de201eec02e40f5634101618bec673755880345b2a | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 05:29

Sharing

Report Analysis Logs

General

Target

c7ce767d99fb4055fca387650fa5b20d.exe
Size

15KB
MD5

c7ce767d99fb4055fca387650fa5b20d
SHA1

2b4e938e1225bc382a5067d6ddeb1d0eeb836924
SHA256

cfefc55c998333b7044417de201eec02e40f5634101618bec673755880345b2a
SHA512

7fa9e2a5b4dc39dae278a49cf77cdacbbe290b10244a4fa376b1075632cf4539cc50568d4214d1de762646dd8800a15b293c32d9d6892f1c2932fc435c250b49
SSDEEP

384:IS76MjQKbH00TDmuUUAS1UVo0frUkvVyh5GV9O8FUj:6ObH00TjUU1UVoIV8+9S

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	2208	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2824	2208	c7ce767d99fb4055fca387650fa5b20d.exe	28
PID 2208 wrote to memory of 2824	2208	c7ce767d99fb4055fca387650fa5b20d.exe	28
PID 2208 wrote to memory of 2824	2208	c7ce767d99fb4055fca387650fa5b20d.exe	28
PID 2208 wrote to memory of 2824	2208	c7ce767d99fb4055fca387650fa5b20d.exe	28

C:\Users\Admin\AppData\Local\Temp\c7ce767d99fb4055fca387650fa5b20d.exe
"C:\Users\Admin\AppData\Local\Temp\c7ce767d99fb4055fca387650fa5b20d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 36
  2⤵
  - Program crash
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download