7ea280179e136a1a753cddc73123975a77ac32ddf48ac9a033513dfe99a9a52e | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:46

Sharing

Report Analysis Logs

General

Target

hzwixydpga.exe
Size

58KB
MD5

a125ad645e6565297bab29355475dbad
SHA1

0c1b472760f288c6a31181165f2ceef63ea69fae
SHA256

0c69de10bce3bbdea0a2db0caf5a79b3864d4d4da59bcae89f08e5b468350681
SHA512

e1dbbfcd03c5f531dd03a0b929249c44fb85838de057c8983de7ce243dd4fe5393c50d4ddf22aa15d4817c1fddb53b4764bc85f3bac47962809c7f74a69a55fe
SSDEEP

768:vFX1hE9FCuqS+dUUo6RoQ7tuSbYuIEfM5I+gI+27rN8cxcNKw2WsUfeWacM:NXo92S+dUwRjlj+vn1c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2052 2152 WerFault.exe hzwixydpga.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

hzwixydpga.exe

description	pid	process	target process
PID 2152 wrote to memory of 2052	2152	hzwixydpga.exe	WerFault.exe
PID 2152 wrote to memory of 2052	2152	hzwixydpga.exe	WerFault.exe
PID 2152 wrote to memory of 2052	2152	hzwixydpga.exe	WerFault.exe
PID 2152 wrote to memory of 2052	2152	hzwixydpga.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\hzwixydpga.exe
"C:\Users\Admin\AppData\Local\Temp\hzwixydpga.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 132
2⤵
- Program crash
PID:2052

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...