f79cdf7e111c2e3e41344fa1d1f5fa0cdbf0acc0892ec96716ac82e23459c4fd | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 05:43

Sharing

Report Analysis Logs

General

Target

d558caece6c9cec0c953dd17c2f6e43d.exe
Size

40KB
MD5

d558caece6c9cec0c953dd17c2f6e43d
SHA1

979f92937014b8791b29893821e0b94a72f22fd6
SHA256

f79cdf7e111c2e3e41344fa1d1f5fa0cdbf0acc0892ec96716ac82e23459c4fd
SHA512

bbcf7ea35a61dedb081fd89d247bffedd5149bb5565803e3e0bdcffd87728a181f46f7be3396136201ed2536d1fe3c563dae154b56423ff27f7145674365bcdc
SSDEEP

768:0uzYIEh1pKS6l75LvfaVJ4jGnKezFsYuZIdB4zPl2:p876blPbZIgzPl2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	1048	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2972	1048	d558caece6c9cec0c953dd17c2f6e43d.exe	28
PID 1048 wrote to memory of 2972	1048	d558caece6c9cec0c953dd17c2f6e43d.exe	28
PID 1048 wrote to memory of 2972	1048	d558caece6c9cec0c953dd17c2f6e43d.exe	28
PID 1048 wrote to memory of 2972	1048	d558caece6c9cec0c953dd17c2f6e43d.exe	28

C:\Users\Admin\AppData\Local\Temp\d558caece6c9cec0c953dd17c2f6e43d.exe
"C:\Users\Admin\AppData\Local\Temp\d558caece6c9cec0c953dd17c2f6e43d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 88
  2⤵
  - Program crash
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads