8ca0dec5b362fac58066a7a0c5750a0c95c59142ae261482bc658d0177f14f8e | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 05:30

Sharing

Report Analysis Logs

General

Target

ca99fd7279ed65c625758407af8d1509.exe
Size

25KB
MD5

ca99fd7279ed65c625758407af8d1509
SHA1

9491df00a34bf900160519584d23de24f8cdf8ec
SHA256

8ca0dec5b362fac58066a7a0c5750a0c95c59142ae261482bc658d0177f14f8e
SHA512

a7d6d9d409f7c01303e08c14d2a92ba206cb592d839608a89c26636ddb7bb0fe57bb9f5b8c4bcafa5038085badc79be684219670086dc73cae983bb937aa7b8c
SSDEEP

384:gCYvMskJfXxcukZGXSd1UC2xNP5JpxqDtxv2iYli:XsafkZGW1UjdlAZYl

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	1188	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2040	1188	ca99fd7279ed65c625758407af8d1509.exe	28
PID 1188 wrote to memory of 2040	1188	ca99fd7279ed65c625758407af8d1509.exe	28
PID 1188 wrote to memory of 2040	1188	ca99fd7279ed65c625758407af8d1509.exe	28
PID 1188 wrote to memory of 2040	1188	ca99fd7279ed65c625758407af8d1509.exe	28

C:\Users\Admin\AppData\Local\Temp\ca99fd7279ed65c625758407af8d1509.exe
"C:\Users\Admin\AppData\Local\Temp\ca99fd7279ed65c625758407af8d1509.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 64
  2⤵
  - Program crash
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads