5176fbdc23e845feacb6068637b64d86488b861f16ab82c1c3d38da306ba295a | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 00:16

Sharing

Report Analysis Logs

General

Target

d4bac10d3c2760014ff9db3defe56baa.exe
Size

40KB
MD5

d4bac10d3c2760014ff9db3defe56baa
SHA1

bcffccfbce0ec7405d837d93e610a63687f4eb9a
SHA256

5176fbdc23e845feacb6068637b64d86488b861f16ab82c1c3d38da306ba295a
SHA512

f9e23d2199cf9fb9717bea8e866b60b20ecb287710274f532d6197903d7a7b51903fa536bf41b34e06268d3f9ffd88c4394f9176b47a944751cb1efb18bbc2b1
SSDEEP

768:JOdBSlAqflp4zcg/bA6+wvUXZ42lowe+o0tiN6x+Zj:J3lAqgzp/06HAbo76x2j

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2912	2860	d4bac10d3c2760014ff9db3defe56baa.exe	28
PID 2860 wrote to memory of 2912	2860	d4bac10d3c2760014ff9db3defe56baa.exe	28
PID 2860 wrote to memory of 2912	2860	d4bac10d3c2760014ff9db3defe56baa.exe	28
PID 2860 wrote to memory of 2912	2860	d4bac10d3c2760014ff9db3defe56baa.exe	28

C:\Users\Admin\AppData\Local\Temp\d4bac10d3c2760014ff9db3defe56baa.exe
"C:\Users\Admin\AppData\Local\Temp\d4bac10d3c2760014ff9db3defe56baa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 92
  2⤵
  - Program crash
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download