6b8925023460fcb4107499a1d5758548a0fce90f44258bf90205cd99d2861722 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 06:36

Sharing

Report Analysis Logs

General

Target

c7ef4aa4a607db0e2559fa070a6ae4b2.exe
Size

214KB
MD5

c7ef4aa4a607db0e2559fa070a6ae4b2
SHA1

062cdb21f0eb0bc1e7f9c68182eb6c3ab4780272
SHA256

6b8925023460fcb4107499a1d5758548a0fce90f44258bf90205cd99d2861722
SHA512

e3bd886d8e79090ed01c40adec34299d841e2fddb513d844115dac9d70fe23d2c5fa945bd90d40f6b1e426e2649788944679bcab5181658705376682c1f18242
SSDEEP

6144:zNcz7NMS8QiUEXjv2BOsw51XeXFJG4PCk4/M:zJShiTj2PK1XiJ76P

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1292	2040	c7ef4aa4a607db0e2559fa070a6ae4b2.exe	28
PID 2040 wrote to memory of 1292	2040	c7ef4aa4a607db0e2559fa070a6ae4b2.exe	28
PID 2040 wrote to memory of 1292	2040	c7ef4aa4a607db0e2559fa070a6ae4b2.exe	28
PID 2040 wrote to memory of 1292	2040	c7ef4aa4a607db0e2559fa070a6ae4b2.exe	28

C:\Users\Admin\AppData\Local\Temp\c7ef4aa4a607db0e2559fa070a6ae4b2.exe
"C:\Users\Admin\AppData\Local\Temp\c7ef4aa4a607db0e2559fa070a6ae4b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 36
  2⤵
  - Program crash
  PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download