f6bdbe6e75fb79fc34eb5699df1e98e25961ff8dab5b7a24143511e5aa9a00d2 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 06:00

Sharing

Report Analysis Logs

General

Target

3afe118b07738f9455bbdb59a7b3c0ae.exe
Size

92KB
MD5

3afe118b07738f9455bbdb59a7b3c0ae
SHA1

ff1c8896595c8efafda8259c5712aea546b5623b
SHA256

f6bdbe6e75fb79fc34eb5699df1e98e25961ff8dab5b7a24143511e5aa9a00d2
SHA512

33e68242210ceeb069344560831f078e3681724dfdefa9dc7c359bfbb5047b2b5ebb6982f169ead530a38a6968b413d4c8cd32e6780f7c1b8e63fe07b6ffbdfa
SSDEEP

1536:SDhqQ7Z+w5WomrunvxyHfjXq+66DFUABABOVLefE3:A7Zh5VmJfj6+JB8M3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	1960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1468	1960	3afe118b07738f9455bbdb59a7b3c0ae.exe	28
PID 1960 wrote to memory of 1468	1960	3afe118b07738f9455bbdb59a7b3c0ae.exe	28
PID 1960 wrote to memory of 1468	1960	3afe118b07738f9455bbdb59a7b3c0ae.exe	28
PID 1960 wrote to memory of 1468	1960	3afe118b07738f9455bbdb59a7b3c0ae.exe	28

C:\Users\Admin\AppData\Local\Temp\3afe118b07738f9455bbdb59a7b3c0ae.exe
"C:\Users\Admin\AppData\Local\Temp\3afe118b07738f9455bbdb59a7b3c0ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 140
  2⤵
  - Program crash
  PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download