13cc6fddfbe7476e40706416a1d3ed2ad3cd4f648def6909481736a16da377a0 | Triage

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 16:27

Sharing

Report Analysis Logs

General

Target

cbe142fbced0c278b0a67ddfa8f63788.exe
Size

24KB
MD5

cbe142fbced0c278b0a67ddfa8f63788
SHA1

5828d9458fe8c5e5a01e204ae85b322dd90a2b51
SHA256

13cc6fddfbe7476e40706416a1d3ed2ad3cd4f648def6909481736a16da377a0
SHA512

f59bad2b6af672cfa81bcf5cecb6a854c505e3dd00838ca0dc5a32a9cebae2af6ef5fd0c1a942f8605b11afb80cee228ce8828386f53586e9c24d88a2ab5e8ec
SSDEEP

384:E3eVES+/xwGSRKJQ4DblM61qmTTMVF9/q5P0:bGS+Zf1JZbO8qYoAs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2652	WerFault.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	cbe142fbced0c278b0a67ddfa8f63788.exe
2652	cbe142fbced0c278b0a67ddfa8f63788.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1992	2652	cbe142fbced0c278b0a67ddfa8f63788.exe	29
PID 2652 wrote to memory of 1992	2652	cbe142fbced0c278b0a67ddfa8f63788.exe	29
PID 2652 wrote to memory of 1992	2652	cbe142fbced0c278b0a67ddfa8f63788.exe	29
PID 2652 wrote to memory of 1992	2652	cbe142fbced0c278b0a67ddfa8f63788.exe	29

C:\Users\Admin\AppData\Local\Temp\cbe142fbced0c278b0a67ddfa8f63788.exe
"C:\Users\Admin\AppData\Local\Temp\cbe142fbced0c278b0a67ddfa8f63788.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 208
  2⤵
  - Program crash
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads