072a9a045e7acba89b5717ed0af74e4ab983caab132253b1101b6101e496ee28 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 12:41

Sharing

Report Analysis Logs

General

Target

de095e3f4b5f313901423fbbc73b2cd1.exe
Size

110KB
MD5

de095e3f4b5f313901423fbbc73b2cd1
SHA1

54d58e509d9d5e68fad43030fbb963ca33712531
SHA256

072a9a045e7acba89b5717ed0af74e4ab983caab132253b1101b6101e496ee28
SHA512

1f4e643009874978bef25fb70edb6a1879d6c9abc8e349fa053440849fc2902a9254a91412ba345b83fc7ce003fd4d8477d1163dc858eea94e3f312181a7de41
SSDEEP

3072:rNzlxeO8nfu0tT1uvYr9E5M8XvCRL7Oi3fD:xTeOQft0YZE5M8XyXlvD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2272	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1728	2272	de095e3f4b5f313901423fbbc73b2cd1.exe	28
PID 2272 wrote to memory of 1728	2272	de095e3f4b5f313901423fbbc73b2cd1.exe	28
PID 2272 wrote to memory of 1728	2272	de095e3f4b5f313901423fbbc73b2cd1.exe	28
PID 2272 wrote to memory of 1728	2272	de095e3f4b5f313901423fbbc73b2cd1.exe	28

C:\Users\Admin\AppData\Local\Temp\de095e3f4b5f313901423fbbc73b2cd1.exe
"C:\Users\Admin\AppData\Local\Temp\de095e3f4b5f313901423fbbc73b2cd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 148
  2⤵
  - Program crash
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2272-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download