0d6a83ceda103cbb0b9c63e4765770cd743541fd329bc06782c92cf7891190fa | Triage

Analysis

max time kernel
153s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 14:53

Sharing

Report Analysis Logs

General

Target

cbb287e5803aa195af0352bb88218baf.exe
Size

116KB
MD5

cbb287e5803aa195af0352bb88218baf
SHA1

d0cb9897a2cd66f81997baaee0c7babf363376c2
SHA256

0d6a83ceda103cbb0b9c63e4765770cd743541fd329bc06782c92cf7891190fa
SHA512

b98f24a9793a066fe8fd0685947fa6ff8d56f9c1857796c2c01b818751d261ed8ac86907aa009397fd3574a07493cde785fcd0fe7c07c73ec79de1b6f57d991b
SSDEEP

3072:IQtYoUlbXx8J27aOQImMrXhOYTD/kpvCJLnY:IQtYHbBfQ+rXhOYnC4Ln

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	1656	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1696	1656	cbb287e5803aa195af0352bb88218baf.exe	27
PID 1656 wrote to memory of 1696	1656	cbb287e5803aa195af0352bb88218baf.exe	27
PID 1656 wrote to memory of 1696	1656	cbb287e5803aa195af0352bb88218baf.exe	27
PID 1656 wrote to memory of 1696	1656	cbb287e5803aa195af0352bb88218baf.exe	27

C:\Users\Admin\AppData\Local\Temp\cbb287e5803aa195af0352bb88218baf.exe
"C:\Users\Admin\AppData\Local\Temp\cbb287e5803aa195af0352bb88218baf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 36
  2⤵
  - Program crash
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download