99e1bceceb91fb0428e701aed4d5a59c8a57be8dd8db75117af75f1e22a533ff | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 10:44

Sharing

Report Analysis Logs

General

Target

e179e29bda030a4d96e60d11d63dc1d2.exe
Size

35KB
MD5

e179e29bda030a4d96e60d11d63dc1d2
SHA1

dc6c6bd1c4e3d10e32430c23d0264044c66a131a
SHA256

99e1bceceb91fb0428e701aed4d5a59c8a57be8dd8db75117af75f1e22a533ff
SHA512

1ddaf9b81449f775bb4e554010483a5cc80b2272bdec714168a8fd16c89fe4dc994884c0c4fd7e3688e16ecace0e432b6f97c9acb376a2463862632efbe354a3
SSDEEP

768:R2oimhjrAgM6S1iStWStxEPILe1u0hP0l2WUlDrX8:YoZrA8S1ivS40MuK8l2WU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2972	2028	e179e29bda030a4d96e60d11d63dc1d2.exe	28
PID 2028 wrote to memory of 2972	2028	e179e29bda030a4d96e60d11d63dc1d2.exe	28
PID 2028 wrote to memory of 2972	2028	e179e29bda030a4d96e60d11d63dc1d2.exe	28
PID 2028 wrote to memory of 2972	2028	e179e29bda030a4d96e60d11d63dc1d2.exe	28

C:\Users\Admin\AppData\Local\Temp\e179e29bda030a4d96e60d11d63dc1d2.exe
"C:\Users\Admin\AppData\Local\Temp\e179e29bda030a4d96e60d11d63dc1d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 140
  2⤵
  - Program crash
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download