14abc00e02cdb2b79ab7add0eacded507ce221f6be30983f39d35971b98b003f | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 11:03

Sharing

Report Analysis Logs

General

Target

D2.exe
Size

1.2MB
MD5

93b842eb7c577b84bb8ed645f504aa72
SHA1

d84bb9aa8a8ef35678d445df0b32425d49771bd2
SHA256

f5f4cab39d65c1d787e0ce217465c3d58afc9a739682da8f20900ec589a908dd
SHA512

011045983c7783968adfb3fa7094aa63cad010eaca852effc9506b0bb74a9b993d557e127ba5a3a1bd3c1d4de5a603f8cf6f17879fe915ed9c9e2a7fd1b09c84
SSDEEP

24576:/KxiiAH280V6GfVDeRzFZMskrfQDmUx5Da1adHJFsq:/KAOV6GfVDePey7pdJFsq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	2964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1536	2964	D2.exe	29
PID 2964 wrote to memory of 1536	2964	D2.exe	29
PID 2964 wrote to memory of 1536	2964	D2.exe	29
PID 2964 wrote to memory of 1536	2964	D2.exe	29

C:\Users\Admin\AppData\Local\Temp\D2.exe
"C:\Users\Admin\AppData\Local\Temp\D2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 52
  2⤵
  - Program crash
  PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2964-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download