03d27ea2dcffd41dabde8db7a7c9a9a005b46bcad4a5f43a9b4ce33ef0b43697 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 15:19

Sharing

Report Analysis Logs

General

Target

cbbef94e23ef2bf92731954d3ec77741.exe
Size

37KB
MD5

cbbef94e23ef2bf92731954d3ec77741
SHA1

ec2264afe7756177048c7b0fb5062bf736c41f11
SHA256

03d27ea2dcffd41dabde8db7a7c9a9a005b46bcad4a5f43a9b4ce33ef0b43697
SHA512

9c1d1aff2f75941de82406c33f4b0b512eac19f75ce058134343535faa58f39ffab381ad7f7b5a619fef58b58aac926d3d765b700ff4e674f3f60e1312eea0e6
SSDEEP

768:mQ/Y1vUXUChGJnGqR0ZvKmk+x8FeKQuf6ghk01W8IIqw:P/aXpR8vKmkefZOWg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 868	3000	cbbef94e23ef2bf92731954d3ec77741.exe	28
PID 3000 wrote to memory of 868	3000	cbbef94e23ef2bf92731954d3ec77741.exe	28
PID 3000 wrote to memory of 868	3000	cbbef94e23ef2bf92731954d3ec77741.exe	28
PID 3000 wrote to memory of 868	3000	cbbef94e23ef2bf92731954d3ec77741.exe	28

C:\Users\Admin\AppData\Local\Temp\cbbef94e23ef2bf92731954d3ec77741.exe
"C:\Users\Admin\AppData\Local\Temp\cbbef94e23ef2bf92731954d3ec77741.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 36
  2⤵
  - Program crash
  PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads