14f209f778cd5adc89dc459969355fea86c20a332ead1790b1e1e1ccb4210019 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dec4a2211de9d1cd3659e73c80237220.exe
Size

24KB
MD5

dec4a2211de9d1cd3659e73c80237220
SHA1

fc654285f6569750c1f60b6135f1a4ee7a12d458
SHA256

14f209f778cd5adc89dc459969355fea86c20a332ead1790b1e1e1ccb4210019
SHA512

3da4b09d23c5125c313ed09bb493382b43489ba8213a07a0295f2e0a2a0644663229923c2628e05ce70389e19ceb34687bafc955b9c5b60ca5ca2f12dcfae042
SSDEEP

384:E3eVES+/xwGSRKJQ4DblM61qmTTMVF9/q5S0:bGS+Zf1JZbO8qYoAz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	2808	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	dec4a2211de9d1cd3659e73c80237220.exe
2808	dec4a2211de9d1cd3659e73c80237220.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 1056	2808	dec4a2211de9d1cd3659e73c80237220.exe	28
PID 2808 wrote to memory of 1056	2808	dec4a2211de9d1cd3659e73c80237220.exe	28
PID 2808 wrote to memory of 1056	2808	dec4a2211de9d1cd3659e73c80237220.exe	28
PID 2808 wrote to memory of 1056	2808	dec4a2211de9d1cd3659e73c80237220.exe	28

C:\Users\Admin\AppData\Local\Temp\dec4a2211de9d1cd3659e73c80237220.exe
"C:\Users\Admin\AppData\Local\Temp\dec4a2211de9d1cd3659e73c80237220.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 208
  2⤵
  - Program crash
  PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads