e748b347a1545774d6fec8dc1265bf06c05784a5b5bccc9908c82c416166031c | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e0439caaddc4e385bb862e7c97baf8c3.exe
Size

24KB
MD5

e0439caaddc4e385bb862e7c97baf8c3
SHA1

1ec26d018dd18fde9cd827195e6379f6bdc41240
SHA256

e748b347a1545774d6fec8dc1265bf06c05784a5b5bccc9908c82c416166031c
SHA512

425deb454c62f82d3fdb519b30ecbf00189f6d1d147905bc7bf8d57025e60081bae3ea6648f4400ca677bbea51de29d50016892bc06c713559d54e8557ef6221
SSDEEP

192:Yr6ayAwTAKWelt8uGs9M6vSr9RPTPGC/awnbE:YtyAuLxHvcRLPnb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	1704	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1340	1704	e0439caaddc4e385bb862e7c97baf8c3.exe	28
PID 1704 wrote to memory of 1340	1704	e0439caaddc4e385bb862e7c97baf8c3.exe	28
PID 1704 wrote to memory of 1340	1704	e0439caaddc4e385bb862e7c97baf8c3.exe	28
PID 1704 wrote to memory of 1340	1704	e0439caaddc4e385bb862e7c97baf8c3.exe	28

C:\Users\Admin\AppData\Local\Temp\e0439caaddc4e385bb862e7c97baf8c3.exe
"C:\Users\Admin\AppData\Local\Temp\e0439caaddc4e385bb862e7c97baf8c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 88
  2⤵
  - Program crash
  PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download