e6a4234417da77f9bd83b07a8001937e74d65a4ab611d25b4a91ae4b307feea2 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 21:10

Sharing

Report Analysis Logs

General

Target

d71f038548bb72deadc2d26de64cbf34.exe
Size

904KB
MD5

d71f038548bb72deadc2d26de64cbf34
SHA1

fa50c47d00928103ef830a443393c8924b32a925
SHA256

e6a4234417da77f9bd83b07a8001937e74d65a4ab611d25b4a91ae4b307feea2
SHA512

96084b7d2033209c1a09a0209ac8153e1ee6ac99acd2122d9d0b1031d814db332a5ffd53c4c9a02bc8f45cf67a2a3f8bf322e5e7ec36c44e80b5a8cf20380a5a
SSDEEP

3072:ft2cWtTBfVkfqM2SCAygRjlIqZoFzJcqLZ:hWtTBdsqEPxjjoFzVZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	2184	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2252	2184	d71f038548bb72deadc2d26de64cbf34.exe	28
PID 2184 wrote to memory of 2252	2184	d71f038548bb72deadc2d26de64cbf34.exe	28
PID 2184 wrote to memory of 2252	2184	d71f038548bb72deadc2d26de64cbf34.exe	28
PID 2184 wrote to memory of 2252	2184	d71f038548bb72deadc2d26de64cbf34.exe	28

C:\Users\Admin\AppData\Local\Temp\d71f038548bb72deadc2d26de64cbf34.exe
"C:\Users\Admin\AppData\Local\Temp\d71f038548bb72deadc2d26de64cbf34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 36
  2⤵
  - Program crash
  PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads