36578a30ba3ce2ff8c807ca1e8c68a92eeb3b9fb40f6e3e297ed25993370609b | Triage

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 20:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e0143f0f34dfb2a907d6684de3454798.exe
Size

33KB
MD5

e0143f0f34dfb2a907d6684de3454798
SHA1

7bae88c6a09bfaa21a394e4c7ef6196b6c41ffa7
SHA256

36578a30ba3ce2ff8c807ca1e8c68a92eeb3b9fb40f6e3e297ed25993370609b
SHA512

41701636af7ff0e4fb547edbdc67a2ff7dc799e25f0633f89c7ed2939bcf0a66c8d0e25540350702443707d6c23881db086a0bc8b072ac78a6028a40584fe98a
SSDEEP

768:XLhc4wAjw2QA77OmzOQ7cKex5kGr6gxQ9DJ0ZwM8xj:XLhcDBAnR6n2gxQ9OwME

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1496	2224	e0143f0f34dfb2a907d6684de3454798.exe	28
PID 2224 wrote to memory of 1496	2224	e0143f0f34dfb2a907d6684de3454798.exe	28
PID 2224 wrote to memory of 1496	2224	e0143f0f34dfb2a907d6684de3454798.exe	28
PID 2224 wrote to memory of 1496	2224	e0143f0f34dfb2a907d6684de3454798.exe	28

C:\Users\Admin\AppData\Local\Temp\e0143f0f34dfb2a907d6684de3454798.exe
"C:\Users\Admin\AppData\Local\Temp\e0143f0f34dfb2a907d6684de3454798.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 88
  2⤵
  - Program crash
  PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-1-0x0000000000100000-0x000000000010F000-memory.dmp

Filesize
60KB

Download