66d013b6fa644e65465e52c644ab7d183fad81239149169e844615240f14c79b | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 09:40

Sharing

Report Analysis Logs

General

Target

cdb98dd2476e88aa64ae9eaaf620fe01.exe
Size

3.6MB
MD5

cdb98dd2476e88aa64ae9eaaf620fe01
SHA1

5fc5981b9fe0551bcfa9e829ebbbbdc62729ef9c
SHA256

66d013b6fa644e65465e52c644ab7d183fad81239149169e844615240f14c79b
SHA512

618b7cf9e4f04f3b992d4d919fb7cbec2e085edf6610d94c6b981f51df3f6454e39f2d24010d3be2db5fb193a37154bc7372e96bc4bf87e29c062e946bc829a7
SSDEEP

49152:zAdGB73ejP3+EMfRdASVaAvrN5Xh602+/:zAgR3epMjASHPht

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 2204 WerFault.exe cdb98dd2476e88aa64ae9eaaf620fe01.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cdb98dd2476e88aa64ae9eaaf620fe01.exe

description	pid	process	target process
PID 2204 wrote to memory of 2160	2204	cdb98dd2476e88aa64ae9eaaf620fe01.exe	WerFault.exe
PID 2204 wrote to memory of 2160	2204	cdb98dd2476e88aa64ae9eaaf620fe01.exe	WerFault.exe
PID 2204 wrote to memory of 2160	2204	cdb98dd2476e88aa64ae9eaaf620fe01.exe	WerFault.exe
PID 2204 wrote to memory of 2160	2204	cdb98dd2476e88aa64ae9eaaf620fe01.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cdb98dd2476e88aa64ae9eaaf620fe01.exe
"C:\Users\Admin\AppData\Local\Temp\cdb98dd2476e88aa64ae9eaaf620fe01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 104
  2⤵
  - Program crash
  PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads