a47e367787506f2d315b458afc3ff5f25baa122ee58f6f6ca46b0099db553ff4 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cdcfd0491afcbbde076983df7c2c47e3.exe
Size

56KB
MD5

cdcfd0491afcbbde076983df7c2c47e3
SHA1

c0ba814bf3ab9bce70ea06f4b0706f28869c9a4c
SHA256

a47e367787506f2d315b458afc3ff5f25baa122ee58f6f6ca46b0099db553ff4
SHA512

82cfb57182505daeb312a0bc97ac59a444dfc59803ebb44f4410ef155f6c4e964df24eb10957c3b9f5d8a2be4951109376c6f55a416b6b9c1c1e997e8cc62d47
SSDEEP

1536:hGtxFi3SfeF5DHGoTKK8zYxFi28QI5VwtGH:h7vG68Ci2a5VwtM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	1368	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2392	1368	cdcfd0491afcbbde076983df7c2c47e3.exe	28
PID 1368 wrote to memory of 2392	1368	cdcfd0491afcbbde076983df7c2c47e3.exe	28
PID 1368 wrote to memory of 2392	1368	cdcfd0491afcbbde076983df7c2c47e3.exe	28
PID 1368 wrote to memory of 2392	1368	cdcfd0491afcbbde076983df7c2c47e3.exe	28

C:\Users\Admin\AppData\Local\Temp\cdcfd0491afcbbde076983df7c2c47e3.exe
"C:\Users\Admin\AppData\Local\Temp\cdcfd0491afcbbde076983df7c2c47e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 36
  2⤵
  - Program crash
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads