599b40aa7b210e6c8204c658da233a7bfe8d3f144860a93a4db498b69969679e | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 21:21

Sharing

Report Analysis Logs

General

Target

out.exe
Size

32KB
MD5

c1b1fccf6394c39515f0f86db27db706
SHA1

019ebac73dae3cbf0958ba52dadc174a4b0b2242
SHA256

647baea011bb1a19c85f0efeeeaffa02f85044656657eed850f0d68f18614469
SHA512

8d128934408213714de2fe6da28558330e11226e1c8a95140a6ae005b64f58e73c4bb76ceff265b8d8a1eaa2042238282440169916708a6d1f826917eb548533
SSDEEP

768:XJt9QXTt8QJZiQcpePcb9eRIdZATwYv1u:Zbq8Qcw5InATwYvY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 1712 WerFault.exe out.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out.exe

description	pid	process	target process
PID 1712 wrote to memory of 2800	1712	out.exe	WerFault.exe
PID 1712 wrote to memory of 2800	1712	out.exe	WerFault.exe
PID 1712 wrote to memory of 2800	1712	out.exe	WerFault.exe
PID 1712 wrote to memory of 2800	1712	out.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 36
2⤵
- Program crash
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download