fce2ab4ea601fa79d9cd210f7c2ea815a22122969f664ac81bfe8a54b1e519a3 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 10:42

Sharing

Report Analysis Logs

General

Target

c86c0eb02806cff13530255c6d70a314.exe
Size

117KB
MD5

c86c0eb02806cff13530255c6d70a314
SHA1

10a4857915b7fc468a14d222f3b483db9505c926
SHA256

fce2ab4ea601fa79d9cd210f7c2ea815a22122969f664ac81bfe8a54b1e519a3
SHA512

dc650e856b3e30a66338ec2e686ce5e9af45bb480b2781fb69d6847a2290d2d5034a6fa06aa616d9a89b79bda4aac1c0cba42915e6e0a24ee8e8a506dcbe3802
SSDEEP

3072:2TSjOhdS+0nsf0r8OfNLECiaH5NS4dh8ilIrgM:s2ODN0nsf0rsC5fSsorgM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2916	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2988	2916	c86c0eb02806cff13530255c6d70a314.exe	28
PID 2916 wrote to memory of 2988	2916	c86c0eb02806cff13530255c6d70a314.exe	28
PID 2916 wrote to memory of 2988	2916	c86c0eb02806cff13530255c6d70a314.exe	28
PID 2916 wrote to memory of 2988	2916	c86c0eb02806cff13530255c6d70a314.exe	28

C:\Users\Admin\AppData\Local\Temp\c86c0eb02806cff13530255c6d70a314.exe
"C:\Users\Admin\AppData\Local\Temp\c86c0eb02806cff13530255c6d70a314.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 36
  2⤵
  - Program crash
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2916-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download