7decea1eb641ff53764a669a32b2f185fba236d46c9d9b2077162a15bc449380 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 05:49

Sharing

Report Analysis Logs

General

Target

e0eb475225af73e12454e5b7972cbd3a.exe
Size

25KB
MD5

e0eb475225af73e12454e5b7972cbd3a
SHA1

446a2cbadd52b9b8379be11491f9538961bf8e3b
SHA256

7decea1eb641ff53764a669a32b2f185fba236d46c9d9b2077162a15bc449380
SHA512

212bca219bea0a7f370a607f76e3f7a203afaeda12ac44d7ed648b4c9c397ca553b50d8c5b503a319b849944a43d00783b3a40b179dd7b870322c8ace59d08fe
SSDEEP

768:XVKBC6SQrdeTYI1XTa9DqJujrQcnvRBfoBalE:XVyC6SQrdvI1XTIDqJkQcv37lE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	1380	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2208	1380	e0eb475225af73e12454e5b7972cbd3a.exe	28
PID 1380 wrote to memory of 2208	1380	e0eb475225af73e12454e5b7972cbd3a.exe	28
PID 1380 wrote to memory of 2208	1380	e0eb475225af73e12454e5b7972cbd3a.exe	28
PID 1380 wrote to memory of 2208	1380	e0eb475225af73e12454e5b7972cbd3a.exe	28

C:\Users\Admin\AppData\Local\Temp\e0eb475225af73e12454e5b7972cbd3a.exe
"C:\Users\Admin\AppData\Local\Temp\e0eb475225af73e12454e5b7972cbd3a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 48
  2⤵
  - Program crash
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads