00a1389397741e429a832789b222bcfa27eeb64752d26477078262a6be1e5b6c | Triage

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 08:30

Sharing

Report Analysis Logs

General

Target

e13aec794ab852539c7ddc9b1684d795.exe
Size

384KB
MD5

e13aec794ab852539c7ddc9b1684d795
SHA1

7cd01153e6223b6b63604bddf960198958bde7bf
SHA256

00a1389397741e429a832789b222bcfa27eeb64752d26477078262a6be1e5b6c
SHA512

c9d6853f20e1462355ca71e8a9322b29a2e92361a4197bd0c00cd24f2e2e9ffc128ba5244a73da4edae2415c8daaaefc6fc320714272e3151fb3a935d7b74474
SSDEEP

12288:brf0P3HD5Y8n7nVzDMfmyQGCs23P9LyB4LnE8O:0P3H1Y87BIfQGC98B2El

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5112 1116 WerFault.exe e13aec794ab852539c7ddc9b1684d795.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e13aec794ab852539c7ddc9b1684d795.exe

description	pid	process	target process
PID 1116 wrote to memory of 5056	1116	e13aec794ab852539c7ddc9b1684d795.exe	e13aec794ab852539c7ddc9b1684d795.exe
PID 1116 wrote to memory of 5056	1116	e13aec794ab852539c7ddc9b1684d795.exe	e13aec794ab852539c7ddc9b1684d795.exe
PID 1116 wrote to memory of 5056	1116	e13aec794ab852539c7ddc9b1684d795.exe	e13aec794ab852539c7ddc9b1684d795.exe

C:\Users\Admin\AppData\Local\Temp\e13aec794ab852539c7ddc9b1684d795.exe
"C:\Users\Admin\AppData\Local\Temp\e13aec794ab852539c7ddc9b1684d795.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\e13aec794ab852539c7ddc9b1684d795.exe
"C:\Users\Admin\AppData\Local\Temp\e13aec794ab852539c7ddc9b1684d795.exe"
2⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 504
2⤵
- Program crash
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1116 -ip 1116
1⤵
PID:488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1116-1-0x00000000005B0000-0x00000000005B2000-memory.dmp

Filesize
8KB

Download