f0013ff0464ff57cc1287f596abcdec17d8bd886512bff481d2511bd0f6d8bc1 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 08:54

Sharing

Report Analysis Logs

General

Target

e14651da745e5fa094da9624ddc0ab90.exe
Size

104KB
MD5

e14651da745e5fa094da9624ddc0ab90
SHA1

c84d6d1310093216be4cdb4b1d69217d0b0f3572
SHA256

f0013ff0464ff57cc1287f596abcdec17d8bd886512bff481d2511bd0f6d8bc1
SHA512

1b622c4523bd143715c4f5218525364ebf7b25bc445bef9d80d83a2a10ae6329ae0a023e433683e3382250b03fd9ec53a3ee939725811170b4bc8b210c9770f4
SSDEEP

3072:v6pmyVf7o4I4zTZSM8S0yRiMg48N5x4eEeDdf:vZyVf7o4IkTZSM8tMw3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	3068	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1992	3068	e14651da745e5fa094da9624ddc0ab90.exe	28
PID 3068 wrote to memory of 1992	3068	e14651da745e5fa094da9624ddc0ab90.exe	28
PID 3068 wrote to memory of 1992	3068	e14651da745e5fa094da9624ddc0ab90.exe	28
PID 3068 wrote to memory of 1992	3068	e14651da745e5fa094da9624ddc0ab90.exe	28

C:\Users\Admin\AppData\Local\Temp\e14651da745e5fa094da9624ddc0ab90.exe
"C:\Users\Admin\AppData\Local\Temp\e14651da745e5fa094da9624ddc0ab90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 36
  2⤵
  - Program crash
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download