84f741de5cbcedd05883a92fd648348958f255ed308c221edb38ea63adad4674 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 16:44

Sharing

Report Analysis Logs

General

Target

d69e070141e5de65487e72d59fa12118.exe
Size

25KB
MD5

d69e070141e5de65487e72d59fa12118
SHA1

c15afc64772ae0a9f3c3e0535749b318d663dc0c
SHA256

84f741de5cbcedd05883a92fd648348958f255ed308c221edb38ea63adad4674
SHA512

d6783cf4ae8da4e41bdad8eba9abe01c8f0247484843074293c1eb3813d90e65e35ecbea8b8b8c2efa3a2c295fd888991c34d388241324c60a422179f7894fca
SSDEEP

768:bsPxGKVeTYI1Xja9DPmjGQcnvRBvoBal0:bsPxGKVvI1XjIDPNQcv3Ll0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2724	1888	d69e070141e5de65487e72d59fa12118.exe	28
PID 1888 wrote to memory of 2724	1888	d69e070141e5de65487e72d59fa12118.exe	28
PID 1888 wrote to memory of 2724	1888	d69e070141e5de65487e72d59fa12118.exe	28
PID 1888 wrote to memory of 2724	1888	d69e070141e5de65487e72d59fa12118.exe	28

C:\Users\Admin\AppData\Local\Temp\d69e070141e5de65487e72d59fa12118.exe
"C:\Users\Admin\AppData\Local\Temp\d69e070141e5de65487e72d59fa12118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 48
  2⤵
  - Program crash
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads