15aaadd5f32eeeb4a5e1d0a32f81eb11dc916b3176ff91703355cc5ef60fa82f | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 08:52

Sharing

Report Analysis Logs

General

Target

cda11e2f381574b5b151d2ecdc82a0bd.exe
Size

475KB
MD5

cda11e2f381574b5b151d2ecdc82a0bd
SHA1

e0646d5822c6573733ab2138052ebe8dd84be674
SHA256

15aaadd5f32eeeb4a5e1d0a32f81eb11dc916b3176ff91703355cc5ef60fa82f
SHA512

16fa3949e9da94ec896615f75468cedf705d1949743dad461d26c5e986eaf5eae1c84f7828adfd406ffd776b0d597e585a1f2b6d8f70972bb537619f3db33853
SSDEEP

12288:PcaPUX47RNMWdqvSk5R088Bo7Tl9fB6n4:PcaPXCSkwE9f44

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	1600	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1704	1600	cda11e2f381574b5b151d2ecdc82a0bd.exe	28
PID 1600 wrote to memory of 1704	1600	cda11e2f381574b5b151d2ecdc82a0bd.exe	28
PID 1600 wrote to memory of 1704	1600	cda11e2f381574b5b151d2ecdc82a0bd.exe	28
PID 1600 wrote to memory of 1704	1600	cda11e2f381574b5b151d2ecdc82a0bd.exe	28

C:\Users\Admin\AppData\Local\Temp\cda11e2f381574b5b151d2ecdc82a0bd.exe
"C:\Users\Admin\AppData\Local\Temp\cda11e2f381574b5b151d2ecdc82a0bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 196
  2⤵
  - Program crash
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x00000000010B0000-0x000000000115A000-memory.dmp

Filesize
680KB

Download
memory/1600-1-0x00000000010B0000-0x000000000115A000-memory.dmp

Filesize
680KB

Download
memory/1600-2-0x00000000010B0000-0x000000000115A000-memory.dmp

Filesize
680KB

Download