ec0e3f40d7c60b705623b9d743de671aeab07ffbca5ee7c4646d6e30fe8d7546 | Triage

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 01:45

Sharing

Report Analysis Logs

General

Target

ca29ff3eb553c5995a5cbb358e18fd20.exe
Size

107KB
MD5

ca29ff3eb553c5995a5cbb358e18fd20
SHA1

7a3f4cf9875cb230aea1575f117ed8c77000e511
SHA256

ec0e3f40d7c60b705623b9d743de671aeab07ffbca5ee7c4646d6e30fe8d7546
SHA512

e81a3c70a17ac7610df5ea056a56fb3e65fe51721dee8f2a962d840fc50ea4eca815b11fc5d07d2246cf32d555340ac1156131c7cb3e346f7e1866cacc53b5a0
SSDEEP

3072:U96xNOZ+EYq8klcPMxtoSzEphwPgKWE6HAj:U9uOdBjoSzEpYzEu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3056 2076 WerFault.exe ca29ff3eb553c5995a5cbb358e18fd20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ca29ff3eb553c5995a5cbb358e18fd20.exe

description	pid	process	target process
PID 2076 wrote to memory of 3056	2076	ca29ff3eb553c5995a5cbb358e18fd20.exe	WerFault.exe
PID 2076 wrote to memory of 3056	2076	ca29ff3eb553c5995a5cbb358e18fd20.exe	WerFault.exe
PID 2076 wrote to memory of 3056	2076	ca29ff3eb553c5995a5cbb358e18fd20.exe	WerFault.exe
PID 2076 wrote to memory of 3056	2076	ca29ff3eb553c5995a5cbb358e18fd20.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ca29ff3eb553c5995a5cbb358e18fd20.exe
"C:\Users\Admin\AppData\Local\Temp\ca29ff3eb553c5995a5cbb358e18fd20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 88
2⤵
- Program crash
PID:3056

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...