c3565b57581e8cdc3ad600d1345dc7699a705d75024f8e6ac3ec1a850a50e00c | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8a8293511ee1d32a3b644c299fe0d84.exe
Size

1024B
MD5

c8a8293511ee1d32a3b644c299fe0d84
SHA1

caf46f9724762056a569a3e3d64bd1cb3fd04dcc
SHA256

c3565b57581e8cdc3ad600d1345dc7699a705d75024f8e6ac3ec1a850a50e00c
SHA512

6bf7138f1fb10fee0357a0c81d7f7a2bf3dc82105cd3def6780ba2e6c2e26cb014074137288d566d9c28d4878bec350260cefd9a3bb68a3dd12635ebc0983eb5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2228	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2720	2228	c8a8293511ee1d32a3b644c299fe0d84.exe	28
PID 2228 wrote to memory of 2720	2228	c8a8293511ee1d32a3b644c299fe0d84.exe	28
PID 2228 wrote to memory of 2720	2228	c8a8293511ee1d32a3b644c299fe0d84.exe	28
PID 2228 wrote to memory of 2720	2228	c8a8293511ee1d32a3b644c299fe0d84.exe	28

C:\Users\Admin\AppData\Local\Temp\c8a8293511ee1d32a3b644c299fe0d84.exe
"C:\Users\Admin\AppData\Local\Temp\c8a8293511ee1d32a3b644c299fe0d84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 36
  2⤵
  - Program crash
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-0-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download