41aed4f33bd4a04e29b24e9dd0b03b8f4e7c62acace397a25a136ea95e77d30b | Triage

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 11:45

Sharing

Report Analysis Logs

General

Target

cdfbad45d62a166441164f7277a6ca1c.exe
Size

125KB
MD5

cdfbad45d62a166441164f7277a6ca1c
SHA1

540e51e51655fc689fb1f30a46b8a01e2b0d0e8c
SHA256

41aed4f33bd4a04e29b24e9dd0b03b8f4e7c62acace397a25a136ea95e77d30b
SHA512

79b90cb09ad1ae304da7cf1471f4267001108444dc12f4fc580c1ae9d5255c2ebb82a372beca9d0d61b4eaa84336be9ade934c7f0daa19b86487fee05ef31031
SSDEEP

3072:DSimabBfZm2d2ppzkr/buWid7zyHt4Y5uvmR6pC:D/TbBV4grDh07ON4oSpC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	2736	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1196	2736	cdfbad45d62a166441164f7277a6ca1c.exe	27
PID 2736 wrote to memory of 1196	2736	cdfbad45d62a166441164f7277a6ca1c.exe	27
PID 2736 wrote to memory of 1196	2736	cdfbad45d62a166441164f7277a6ca1c.exe	27
PID 2736 wrote to memory of 1196	2736	cdfbad45d62a166441164f7277a6ca1c.exe	27

C:\Users\Admin\AppData\Local\Temp\cdfbad45d62a166441164f7277a6ca1c.exe
"C:\Users\Admin\AppData\Local\Temp\cdfbad45d62a166441164f7277a6ca1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 36
  2⤵
  - Program crash
  PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2736-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download