8ceb6cb0734fafd52bb3dee86d3a211c26c075b67adcb08ba0c51abf1a7b7255 | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 02:37

Sharing

Report Analysis Logs

General

Target

e0909b49162eb689e31d1c8a349dd3d7.exe
Size

25KB
MD5

e0909b49162eb689e31d1c8a349dd3d7
SHA1

85d03c22cf558dc3dedc7094d2749a21200daddc
SHA256

8ceb6cb0734fafd52bb3dee86d3a211c26c075b67adcb08ba0c51abf1a7b7255
SHA512

9c152faf4cce97181644ec06cdd4dce9d8a81dd72766aa1799f0c776c71eeed145cf27453c3cca3a82bb2cc5f052ff76ba67e3df9dff65e7543f811d103acfa4
SSDEEP

768:H411+v4CJ+VFTX6RwcCHhlhFSyoyC2AOG:H4rC6FrD/lhk2p

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1728	2032	e0909b49162eb689e31d1c8a349dd3d7.exe	28
PID 2032 wrote to memory of 1728	2032	e0909b49162eb689e31d1c8a349dd3d7.exe	28
PID 2032 wrote to memory of 1728	2032	e0909b49162eb689e31d1c8a349dd3d7.exe	28
PID 2032 wrote to memory of 1728	2032	e0909b49162eb689e31d1c8a349dd3d7.exe	28

C:\Users\Admin\AppData\Local\Temp\e0909b49162eb689e31d1c8a349dd3d7.exe
"C:\Users\Admin\AppData\Local\Temp\e0909b49162eb689e31d1c8a349dd3d7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 88
  2⤵
  - Program crash
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2032-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2032-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download