9820c8ccc4187b7e3d917300b59d25f2cbc8febb295162ddec4fbb2bc7711d80 | Triage

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 19:07

Sharing

Report Analysis Logs

General

Target

cc3193aec2083a47882b03179821d2da.exe
Size

68KB
MD5

cc3193aec2083a47882b03179821d2da
SHA1

95e63cfaed51ce94ab46da2ecc49b2a26c6be90c
SHA256

9820c8ccc4187b7e3d917300b59d25f2cbc8febb295162ddec4fbb2bc7711d80
SHA512

3d3f85c8d2d8cd3d1e3f58be5916055696c35ef97a5c39f5b984aa57a94f1013b079e4df419a8438184e2bc93767107dbf4b4f3308b71998c3ec41843bb96e7a
SSDEEP

1536:21D5BC6idDhNEp2zAxrBHExn1HC09Aa/TLUjA7z:SDKdRmlQCApHcA7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	2860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1960	2860	cc3193aec2083a47882b03179821d2da.exe	28
PID 2860 wrote to memory of 1960	2860	cc3193aec2083a47882b03179821d2da.exe	28
PID 2860 wrote to memory of 1960	2860	cc3193aec2083a47882b03179821d2da.exe	28
PID 2860 wrote to memory of 1960	2860	cc3193aec2083a47882b03179821d2da.exe	28

C:\Users\Admin\AppData\Local\Temp\cc3193aec2083a47882b03179821d2da.exe
"C:\Users\Admin\AppData\Local\Temp\cc3193aec2083a47882b03179821d2da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 36
  2⤵
  - Program crash
  PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2860-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download